Public Works and 
Government Services 
Canada 


Travaux publics et 


Canada 


Purchasing Office - Bureau des achats: 
Informatics Professional Services - EL 
Division/Services professionnels en informatique - 
division EL 

Terrasses de la Chaudière 4th Floor 

10 Wellington Street 

Gatineau 

Québec 

KIA 0S5 


CONTRACT - CONTRAT 


You are requested to sell to Her Majesty the Queen 

in right of Canada, in accordance with the terms and conditions 
set out herein, referred to herein or attached hereto, the goods, 
services, and construction listed herein and on any attached 
sheets at the price or prices set out therefor. 


Nous vous demandons de vendre à Sa Majesté 

la Reine du chef du Canada, aux conditions énoncées ou 
incluses par référence dans les présentes, et aux annexes 
ci-jointes, les biens, services et construction énumérés dans 

les présentes, et sur toute feuille ci-annexée, au(x) prix indiqué(s). 


The Vendor/Firm hereby accepts/acknowledges this 
contract. 

Le fournisseur/entrepreneur accepte le présent contrat/en 
accuse réception. 


Date 


Signature 
Name, title of person authorized to sign (type or print) 
Nom et titre du signataire autorisé (taper ou imprimer) 


Comments - Commentaires 


Vendor/Firm Name and Address 


Raison sociale et adresse du 
fournisseur/de l'entrepreneur 


894658699PG0005 

TEKSYSTEMS CANADA CORP/SOCIÉTÉ 
TEKSYSTEMS CANADA 

123 Slater Street, Suite 1000 

123 Slater Street, Suite 1000 

Ottawa 

Ontario 

K1P5H2 

Canada 

Operating as: TEKsystems 


CBSA - Released under the Access to Inf 
k 


Services gouvernementaux 


Title - Sujet 

TBIPS Engineering Professional Serv 

Contract No. - N° du contrat 
47419-198132/001/EL 

Client Reference No. - N° de référence du client 
1000348132 

Requisition No. - N° de la demande 
47419-198132 

File No. - N° de dossier 
606e1.47419-198132 


Date 
2020-07-23 


CCC No./N° CCC - FMS No./N° VME 


Financial Code(s) GST/HST 
Code(s) financier(s) TPS/TVH 
0850 

F.O.B. - F.A.B. 

Destination 


GST/HST - TPS/TVH 
See Herein - Voir ci-inclus 


Duty - Droits 
See Herein - Voir ci-inclus 


Destination - of Goods, Services, and Construction: 
Destination - des biens, services et construction: 


Specified Herein 
Précisé dans les présentes 


Invoices - Original and two copies to be sent to: 
Factures - Envoyer l'original et deux copies à: 


Specified Herein 
Précisé dans les présentes 


Address Enquiries to: - Adresser toutes questions à: Buyer ld - Id de l'acheteur 


606el 


FAX No. - N° de FAX 
() - 


Currency Type - Devise 
CAD 


Mansour, Silvana 


Telephone No. - N° de téléphone 
(613) 858-9935 ( ) 


Total Estimated Cost - Coüt total estimatif 
$15,980,000.00 


For the Minister - Pour le Ministre 


Digitally signed by Mansour, Silvana 
Date: 2020.07.23 11:17:42 -04'00' 


Mansour, Silvana 
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INFORMATICS PROFESSIONAL SERVICES (TBIPS) 
VARIOUS RESOURCE CATEGORIES - LEVEL 3 
FOR 
CANADA BORDER SERVICES AGENCY 
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List of Annexes to the Resulting Contract: 
Annex A Statement of Work 

Annex B Basis of Payment 

Annex C Security Requirements Check List 
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(b) 
(c) 


(d) 


(a) 


(b) 


(c) 


Requirement 


TEKsystems Canada Corporation (the "Contractor") agrees to supply to the Client the services 

described in the Contract, including the Statement of Work, in accordance with, and at the prices 
set out in, the Contract. This includes providing professional services as and when requested by 
Canada, to one or more locations to be designated by Canada, excluding any locations in areas 

subject to any of the Comprehensive Land Claims Agreements. 


Client: Under the Contract, the "Client" is Canada Border Services Agency (CBSA). 


Reorganization of Client: The Contractor's obligation to perform the Work will not be affected by 
(and no additional fees will be payable as a result of) the renaming, reorganization, 
reconfiguration, or restructuring of any Client. The reorganization, reconfiguration and 
restructuring of the Client includes the privatization of the Client, its merger with another entity, or 
its dissolution, where that dissolution is followed by the creation of another entity or entities with 
mandates similar to the original Client. In connection with any form of reorganization, Canada 
may designate another department or government body as the Contracting Authority or Technical 
Authority, as required to reflect the new roles and responsibilities associated with the 
reorganization. 


Defined Terms: Words and expressions defined in the General Conditions or Supplemental 
General Conditions and used in the Contract have the meanings given to them in the General 
Conditions or Supplemental General Conditions. Any reference to an Identified User in the Supply 
Arrangement is a reference to the Client. Also, any reference to a "deliverable" or "deliverables" 
includes all documentation outlined in this Contract. A reference to a "local office" of the 
Contractor means an office having at least one full time employee that is not a shared resource 
working at that location. 


Task Authorization 


As-and-when-requested Task Authorizations: The Work or a portion of the Work to be 
performed under the Contract will be on an "as-and-when-requested basis" using a Task 
Authorization (TA). The Work described in the TA must be in accordance with the scope of the 
Contract. The Contractor must not commence work until a validly issued TA has been issued by 
Canada and received by the Contractor. The Contractor acknowledges that any work performed 
before such issuance and receipt will be done at the Contractor's own risk. 


Assessment of Resources Proposed at TA Stage: Processes for issuing, responding to and 
assessing Task Authorizations are further detailed in Appendices A, B, C and D of Annex A. 


Form and Content of draft Task Authorization: 


(i) The Technical Authority will provide the Contractor with a description of the task in a draft 
Task Authorization using the form specified in Appendix B to Annex A. 


(ii) The draft Task Authorization will contain the details of the activities to be performed, and 
must also contain the following information: 


(A) the contract number; 
(B) the task number; 


(C) the date by which the Contractor's response must be received (which will appear 
in the draft Task Authorization, but not the issued Task Authorization); 


(D) the categories of resources and the number required; 


(E) a description of the work for the task outlining the activities to be performed and 
identifying any deliverables (such as reports); 
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(d) 


(e) 


(f) 


(F) the start and completion dates; 


(G) any option(s) to extend initial end date (if applicable); 


(H) milestone dates for deliverables and payments (if applicable); 
(I) the number of person-days of effort required; 

(J) whether the work requires on-site activities and the location; 
(K) the language profile of the resources required; 

(L) the level of security clearance required of resources; 


(M) the price payable to the Contractor for performing the task, with an indication of 
whether it is a firm price or a maximum TA price (and, for maximum price task 
authorizations, the TA must indicate how the final amount payable will be 
determined; where the TA does not indicate how the final amount payable will be 
determined, the amount payable is the amount, up to the maximum, that the 
Contractor demonstrates was actually worked on the project, by submitting time 
sheets filled in at the time of the work by the individual resources to support the 
charges); and 


(N) any other constraints that might affect the completion of the task. 


Contractor's Response to Draft Task Authorization: The Contractor must provide to the 
Technical Authority, within two working days of receiving the draft Task Authorization (or within 
any longer time period specified in the draft TA), a quotation with the proposed total price for 
performing the task and a breakdown of that cost, established in accordance with the Basis of 
Payment specified in the Contract, as well as its corresponding proposed resource(s) in 
accordance with Appendix C to Annex A of the Contract. The Contractor's quotation must be 
based on the rates set out in the Contract. The Contractor will not be paid for preparing or 
providing its response or for providing other information required to prepare and validly issue the 
TA. 


Task Authorization Limit and Authorities for Validly Issuing Task Authorizations: 
To be validly issued, a TA must include the following signatures: 


(i) for any TA, inclusive of revisions, with a value less than or equal to $300,000.00 
(excluding Applicable Taxes), the TA must be signed by the Technical Authority and the 
Contractor; and 


(ii) for any TA with a value greater than this amount, a TA must be signed by the Technical 
Authority, the Contracting Authority and the Contractor. 


Any TA that does not bear the appropriate signature(s) is not validly issued by Canada. 


Any work performed by the Contractor without receiving a validly issued TA is done at the 


Contractor's own risk. If the Contractor receives a TA that is not appropriately signed, the 
Contractor must notify the Contracting Authority. By providing written notice to the 


Contractor, the Contracting Authority may suspend the Client's ability to issue TA’s at any 


time, or reduce the dollar value threshold described in sub-article (i) above; any 
suspension or reduction notice is effective upon receipt. 


Periodic Usage Reports: 


(i) The Contractor must compile and maintain records on its provision of services to the 
federal government under Task Authorizations validly issued under the Contract. The 
Contractor must provide this data to Canada in accordance with the reporting 
requirements detailed below. If some data is not available, the reason must be indicated. 
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If services are not provided during a given period, the Contractor must still provide a 
"NIL" report. The data must be submitted on a quarterly basis to the Contracting 
Authority. From time to time, the Contracting Authority may also require an interim report 
during a reporting period. 


(ii) The quarterly periods are defined as follows: 


(A) 
(B) 
(C) 
(D) 


13t quarter: April 1 to June 30; 
2nd quarter: July 1 to September 30; 
3™ quarter: October 1 to December 31; and 


4th quarter: January 1 to March 31. 


The data must be submitted to the Contracting Authority no later than 15 calendar days 
after the end of the reporting period. 


(iii) Each report must contain the following information for each validly issued TA (as 
amended): 


(A) 


(B) 
(C) 


(D) 


(E) 


(F) 
(G) 


the Task Authorization number and the Task Authorization Revision number(s), if 
applicable; 


a title or a brief description of each authorized task; 


the name, Resource category and level of each resource involved in performing 
the TA, as applicable; 


the total estimated cost specified in the validly issued TA of each task, exclusive 
of Applicable Taxes; 


the total amount, exclusive of Applicable Taxes, expended to date against each 
authorized task; 


the start and completion date for each authorized task; and 


the active status of each authorized task, as applicable (e.g., indicate whether 
work is in progress or if Canada has cancelled or suspended the TA, etc.). 


(iv) Each report must also contain the following cumulative information for all the validly 
issued TA's (as amended): 


(A) 


(B) 


the amount, exclusive of Applicable Taxes, specified in the Contract (as last 
amended, as applicable) as Canada's total liability to the Contractor for all validly 
issued TA's; and 


the total amount, exclusive of Applicable Taxes, expended to date against all 
validly issued TA's. 


Consolidation of TA's for Administrative Purposes: The Contract may be amended from time 
to time to reflect all validly issued Task Authorizations to date, to document the Work performed 
under those TA's for administrative purposes. 


Minimum Work Guarantee 


In this clause, 


(i) "Maximum Contract Value" means the amount specified in the "Limitation of 
Expenditure" clause set out in the Contract; and 


(il) "Minimum Contract Value" means $20,000.00 (excluding Applicable Taxes). 
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(b) 


(c) 


(d) 


4. 


Canada's obligation under the Contract is to request Work in the amount of the Minimum Contract 
Value or, at Canada's option, to pay the Contractor at the end of the Contract in accordance with 
sub-article (c), subject to sub-article (d). In consideration of such obligation, the Contractor agrees 
to stand in readiness throughout the Contract Period to perform the Work described in the 
Contract. Canada's maximum liability for work performed under the Contract must not exceed the 
Maximum Contract Value, unless an increase is authorized in writing by the Contracting Authority. 


In the event that Canada does not request work in the amount of the Minimum Contract Value 
during the Contract Period, Canada must pay the Contractor the difference between the Minimum 
Contract Value and the total cost of the Work requested. 


Canada will have no obligation to the Contractor under this article if Canada terminates the entire 
Contract 


(i) for default; 


(il) for convenience as a result of any decision or recommendation of a tribunal or court that 
the contract be cancelled, re-tendered or awarded to another supplier; or 


(iii) for convenience within ten business days of Contract award. 


Standard Clauses and Conditions 


All clauses and conditions identified in the Contract by number, date and title are set out in the Standard 
Acquisition Clauses and Conditions Manual (https://buyandsell.gc.ca/policy-and-guidelines/standard- 
acquisition-clauses-and-conditions-manual) issued by Public Works and Government Services Canada. 


(a) 


(b) 


General Conditions: 


(i) 2035 (2018-06-21), General Conditions - Higher Complexity - Services, apply to and form 
part of the Contract. 


With respect to Section 30 - Termination for Convenience, of General Conditions 2035, 
Subsection 04 is deleted and replaced with the following Subsections 04, 05 and 06: 


4. The total of the amounts, to which the Contractor is entitled to be paid under this section, 
together with any amounts paid, due or becoming due to the Contractor must not exceed 
the Contract Price. 


o: Where the Contracting Authority terminates the entire Contract and the Articles of 
Agreement include a Minimum Work Guarantee, the total amount to be paid to the 
Contractor under the Contract will not exceed the greater of: 


(a) the total amount the Contractor may be paid under this section, together with any 
amounts paid, becoming due other than payable under the Minimum Work 
Guarantee, or due to the Contractor as of the date of termination, or 


(b) the amount payable under the Minimum Work Guarantee, less any amounts paid, 
due or otherwise becoming due to the Contractor as of the date of termination. 


6. The Contractor will have no claim for damages, compensation, loss of profit, allowance 
arising out of any termination notice given by Canada under this section except to the 
extent that this section expressly provides. The Contractor agrees to repay immediately 
to Canada the portion of any advance payment that is unliquidated at the date of the 
termination. 


Supplemental General Conditions: 


The following Supplemental General Conditions: 
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5. 


(i) 4002 (2010-08-16), Supplemental General Conditions - Software Development or 
Modification Services; 


(il) 4008 (2008-12-12), Supplemental General Conditions - Personal Information; 


apply to and form part of the Contract. 


Security Requirement 


The following security requirements (SRCL Common #19 and related clauses provided by the Contract 
Security Program) as set out under Annex “B” to the Supply Arrangement, applies to and forms part of the 
Contract. 


(a) 


The Contractor must, at all times during the performance of the Contract, hold a valid Facility 
oecurity Clearance at the level of Secret, issued by the Canadian Industrial Security Directorate 
(CISD), Public Works and Government Services Canada (PWGSC) 


The Contractor personnel requiring access to protected/classified information, assets or sensitive 
Work site(s) must EACH hold a valid personnel security screening at the level of Reliability 
Status, Confidential or Secret as required, granted or approved by CISD/PWGSC 


The Contractor must not remove any protected/classified information from the identified work 
site(s), and the Contractor must ensure that its personnel are made aware of and comply with this 
restriction 


Subcontracts which contain security requirements are not to be awarded without the prior written 
permission of CISD/PWGSC 


The Contractor must comply with the provisions of the: 


1. Security Requirements Check List and security guide (if applicable), attached at Annex C 
2. Industrial Security Manual (Latest Edition) 


Additionally, resources may be assessed for Reliability Status or Secret by the Technical 
Authority prior to commencing the Work, and from time to time throughout the Contract Period. 
The assessment may include a credit check. Upon request of the Technical Authority, in respect 
of any given resource, the Contractor must submit: 


(i) the current level of security clearance granted or approved by CISD/PWGSC; and 


(il) a completed signed TBS 330-23 Form - Personnel Screening, Consent and Authorization 
Form (http://www.tbs-sct.gc.ca/tbsf-fsct/330-23-eng.pdf). 


In the event a resource does not pass the Technical Authority's assessment, Canada may 
immediately, and without further notice, terminate the Contract for default in accordance with the 
General Conditions. 


Contract Period 


Contract Period: The "Contract Period" is the entire period of time during which the Contractor 
is obliged to perform the Work, which includes: 


(i) The "Initial Contract Period", which begins on August 4, 2020 and ends three years 
later on August 3, 2023; and 


(ii) The period during which the Contract is extended, if Canada chooses to exercise any 
options set out in the Contract. 
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(b) 


(a) 


(b) 


Option to Extend the Contract: 


(i) The Contractor grants to Canada the irrevocable option to extend the term of the 
Contract by up to two additional one-year period(s) under the same terms and conditions. 
The Contractor agrees that, during the extended period of the Contract, it will be paid in 
accordance with the applicable provisions set out in the Basis of Payment. 


(ii) Canada may exercise this option at any time by sending a written notice to the Contractor 
before the expiry date of the Contract. The option may only be exercised by the 
Contracting Authority, and will be evidenced, for administrative purposes only, through a 
contract amendment. 


Authorities 
Contracting Authority 
The Contracting Authority for the Contract is: 


Name: Silvana Mansour 

Title: Supply Team Leader 

Public Works and Government Services Canada 

Acquisitions Branch 

Directorate: Professional Services Procurement Directorate 
Address: 10 Wellington St., Gatineau, Québec 
Telephone: (613) 858-9935 

E-mail address: Silvana.b.mansour@tpsgc-pwgsc.gc.ca 


The Contracting Authority is responsible for the management of the Contract and any changes to 
the Contract must be authorized in writing by the Contracting Authority. The Contractor must not 
perform work in excess of or outside the scope of the Contract based on verbal or written 
requests or instructions from anybody other than the Contracting Authority. 


Technical Authority 
The Technical Authority for the Contract is: 


Name: Antonio Utano 

Title: Executive Director 

Organization: Information, Science and Technology Branch (ISTB) 
Address: 333 North River Road, Tower B 

Telephone: 343-291-5129 

E-mail address: Antonio.utano@cbsa-asfc.gc.ca 


The Technical Authority is the representative of the department or agency for whom the Work is 
being carried out under the Contract and is responsible for all matters concerning the technical 
content of the Work under the Contract. Technical matters may be discussed with the Technical 
Authority; however, the Technical Authority has no authority to authorize changes to the scope of 
the Work. Changes to the scope of the Work can only be made through a contract amendment 
issued by the Contracting Authority. 


In his absence, the Technical Authority for the Contract is: 


Name: Cameron MacDonald 

Title: Director General 

Organization: Information, Science and Technology Branch (ISTB) 
Address: 333 North River Road, Tower B 
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Telephone: 343-291-6018 / 613-899-7421 
E-mail address: Cameron.macdonald@cbsa-asfc.gc.ca 
(c) Contractor's Representative 
Name: 
Title: Account Manager 
Address: 123 Slater Street, Suite 1000 
Ottawa, ON K1P 5H2 
Telephone: 613-726-3000 
Facsimile: 613-726-8055 
E-mail address: | | and Froposaileam(@TEkesvstems.com 


8. Proactive Disclosure of Contracts with Former Public Servants 


By providing information on its status, with respect to being a former public servant in receipt of a Public 
Service Superannuation Act (PSSA) pension, the Contractor has agreed that this information will be 
reported on departmental web sites as part of the published proactive disclosure reports, in accordance 
with Contracting Policy Notice: 2012-2 of the Treasury Board Secretariat of Canada. 


9. Payment 
(a) Basis of Payment 
(i) Professional Services provided under a Task Authorization with a Maximum Price: 


For professional services requested by Canada, in accordance with a validly issued Task 
Authorization, Canada will pay the Contractor, in arrears, up to the Maximum Price for the 
TA, for actual time worked and any resulting deliverables in accordance with the firm all- 
inclusive per diem rates set out in Annex B, Basis of Payment, Applicable Taxes extra. 
Partial days will be prorated based on actual hours worked based on a 7.5-hour workday. 


(ii) Professional Services provided under a Task Authorization with a Firm Price: For 
professional services requested by Canada, in accordance with a validly issued Task 
Authorization, Canada will pay the Contractor the firm price set out in the Task 
Authorization (based on the firm, all-inclusive per diem rates set out in Annex B), 
Applicable Taxes extra. 


(iii) Travel and Living Expenses - National Joint Council Travel Directive: The 
Contractor will be reimbursed its authorized travel and living expenses reasonably and 
properly incurred in the performance of the Work, at cost, without any allowance for profit 
and/or administrative overhead, in accordance with the meal and private vehicle 
expenses provided in Appendices B, C and D of the National Joint Council Travel 
Directive and with the other provisions of the directive referring to "travellers", rather than 
those referring to “employees”. All travel must have the prior authorization of the 
Technical Authority. Travel requests will only be considered for a work location which is 
located more than 100 kilometers from the National Capital Region. The Contractor will 
be paid for actual time spent travelling in accordance with the firm per diem rate set out in 
Annex B which per diem is based on a 7.5-hour workday. All payments are subject to 
government audit. 


(iv) Competitive Award: The Contractor acknowledges that the Contract has been awarded 
as a result of a competitive process. No additional charges will be allowed to compensate 
for errors, oversights, misconceptions or underestimates made by the Contractor when 
bidding for the Contract. 
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(b) 


(c) 


(v) 


(vi) 


Contractor's Firm Per Diem Rates: The Contractor agrees that the rates set out in 
Annex B remain firm throughout the Contract Period, except as may be provided for in 
the express terms of the contract. In reference to Article 18 (1) of SACC General 
Conditions 2035, the Contractor acknowledges that its obligation to provide services in 
accordance with the firm rates set out in Annex B is unaffected by the application of any 
existing law or any new law which may come into effect during the Contract Period. 


Professional Services Rates: In Canada's experience, bidders from time to time 
propose rates at the time of bidding for one or more Resource Categories that they later 
refuse to honour, on the basis that these rates do not allow them to recover their own 
costs and/or make a profit. This denies Canada of the benefit of the awarded contract. If 
the Contractor does not respond or refuses to provide an individual with the qualifications 
described in the Contract within the time described in the Contract (or proposes instead 
to provide someone from an alternate category at a different rate), whether or not 
Canada terminates the Contract as a whole or in part or chooses to exercise any of the 
rights provided to it under the general conditions, Canada may impose sanctions or take 
other measures in accordance with the PWGSC Vendor Performance Corrective 
Measure Policy (or equivalent) then in effect, which measures may include an 
assessment that results in conditions applied against the Contractor to be fulfilled before 
doing further business with Canada, or full debarment of the Contractor from bidding on 
future requirements. 


Limitation of Expenditure — Cumulative Total of all Task Authorizations 


(1) 


(ii) 


(iii) 


(i) 


Canada’s total liability to the Contractor under the Contract for all validly issued Task 
Authorizations (TAs), inclusive of any revisions, must not exceed the amount set out on 
page 1 of the Contract, less any Applicable taxes. With respect to the amount set out on 
page 1 of the Contract, Customs duties are excluded and Applicable Taxes are included 


No increase in the total liability of Canada will be authorized or paid to the Contractor 
unless an increase has been approved, in writing, by the Contracting Authority. 


The Contractor must notify the Contracting Authority in writing as to the adequacy of this 
sum: 


(A) when it is 75 percent committed, or 
(B) 4 months before the contract expiry date, or 
(C) As soon as the Contractor considers that the sum is inadequate for the 


completion of the Work required in all authorized TAs, inclusive of any revisions, 
whichever comes first. 


If the notification is for inadequate contract funds, the Contractor must provide to the 
Contracting Authority a written estimate for the additional funds required. Providing this 
information does not increase Canada's liability. 


Method of Payment for Task Authorizations with a Maximum Price: For each Task 
Authorization validly issued under the Contract that contains a maximum price: 


(1) 


(ii) 


Canada will pay the Contractor no more frequently than once a month in accordance with 
the Basis of Payment. The Contractor must submit time sheets for each resource 
showing the days and hours worked to support the charges claimed in the invoice. 


Once Canada has paid the maximum TA price, Canada will not be required to make any 
further payment, but the Contractor must complete all the work described in the TA, all of 
which is required to be performed for the maximum TA price. If the work described in the 
TA is completed in less time than anticipated, and the actual time worked (as supported 
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(d) 


(e) 


(f) 


(9) 


by the time sheets) at the rates set out in the Contract is less than the maximum TA 
price, Canada is only required to pay for the time spent performing the work related to 
that TA. 


Method of Payment for Task Authorizations with a Firm Price - Lump Sum Payment on 
Completion: Canada will pay the Contractor upon completion and delivery of all the Work 
associated with the validly issued Task Authorization in accordance with the payment provisions 
of the Contract if: 


(i) an accurate and complete invoice and any other documents required by the Contract 
have been submitted in accordance with the invoicing instructions provided in the 
Contract; 

(ii) all such documents have been verified by Canada; and 


(iii) the Work delivered has been accepted by Canada. 
Electronic Payment of Invoices — Contract 


The Contractor accepts to be paid using any of the following Electronic Payment Instrument(s): 


(i) Direct Deposit (Domestic and International); 


Time Verification 


Time charged and the accuracy of the Contractor’s time recording system are subject to 
verification by Canada, before or after payment is made to the Contractor. If verification is done 
after payment, the Contractor must repay any overpayment, at Canada’s request. 


Payment Credits 
(i) Failure to Provide Resource: 


(A) If the Contractor does not provide a required professional services resource that 
has all the required qualifications within the time prescribed by the Contract, the 
Contractor must credit to Canada an amount equal to the per diem rate (based on 
a 7.5-hour workday) of the required resource for each day (or partial day) of delay 
in providing the resource, up to a maximum of 10 days. 


(B) Corrective Measures: If credits are payable under this Article for two 
consecutive months or for three months in any 12-month period, the Contractor 
must submit a written action plan describing measures it will implement or actions 
it will undertake to eliminate the recurrence of the problem. The Contractor will 
have five working days to deliver the action plan to the Client and the Contracting 
Authority and 20 working days to rectify the underlying problem. 


(C) Termination for Failure to Meet Availability Level: In addition to any other 
rights it has under the Contract, Canada may terminate the Contract for default in 
accordance with the General Conditions by giving the Contractor three months' 
written notice of its intent, if any of the following apply: 


(1) the total amount of credits for a given monthly billing cycle reach a level 
of 1096 of the total billing for that month; or 

(2) the corrective measures required of the Contractor described above are 
not met. 
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(h) 


10. 


(a) 


(b) 


(ii) 


(iii) 


(iv) 


(v) 


(vi) 


This termination will be effective when the three month notice period expires, 
unless Canada determines that the Contractor has implemented the corrective 
measures to Canada's satisfaction during those three months. 


Credits Apply during Entire Contract Period: The Parties agree that the credits apply 
throughout the Contract Period. 


Credits represent Liquidated Damages: The Parties agree that the credits are 
liquidated damages and represent their best pre-estimate of the loss to Canada in the 
event of the applicable failure. No credit is intended to be, nor will it be construed as, a 
penalty. 


Canada's Right to Obtain Payment: The Parties agree that these credits are a 
liquidated debt. To collect the credits, Canada has the right to hold back, draw back, 
deduct or set off from and against any money Canada owes to the Contractor from time 
to time. 


Canada's Rights & Remedies not Limited: The Parties agree that nothing in this 
Article limits any other rights or remedies to which Canada is entitled under the Contract 
(including the right to terminate the Contract for default) or under the law generally. 


Audit Rights: The Contractor's calculation of credits under the Contract is subject to 
verification by government audit, at the Contracting Authority's discretion, before or after 
payment is made to the Contractor. The Contractor must cooperate fully with Canada 
during the conduct of any audit by providing Canada with access to any records and 
systems that Canada considers necessary to ensure that all credits have been accurately 
credited to Canada in the Contractor's invoices. If an audit demonstrates that past 
invoices contained errors in the calculation of the credits, the Contractor must pay to 
Canada the amount the audit reveals was required to be credited to Canada, plus 
interest, from the date Canada remitted the excess payment until the date of the refund 
(the interest rate is the Bank of Canada's discount annual rate of interest in effect on the 
date the credit was first owed to Canada, plus 1.2596 per year). If, as a result of 
conducting an audit, Canada determines that the Contractor's records or systems for 
identifying, calculating or recording the credits are inadequate, the Contractor must 
implement any additional measures required by the Contracting Authority. 


No Responsibility to Pay for Work not performed due to Closure of Government Offices 


(i) 


(ii) 


Where the Contractor, its employees, subcontractors, or agents are providing services on 
government premises under the Contract and those premises are inaccessible because 
of the evacuation or closure of government offices, and as a result no work is performed, 
Canada is not responsible for paying the Contractor for work that otherwise would have 
been performed if there had been no evacuation or closure. 


If, as a result of any strike or lock-out, the Contractor or its employees, subcontractors or 
agents cannot obtain access to government premises and, as a result, no work is 
performed, Canada is not responsible for paying the Contractor for work that otherwise 
would have been performed if the Contractor had been able to gain access to the 
premises 


Invoicing Instructions 


The Contractor must submit invoices in accordance with the information required in the General 
Conditions. 


The Contractor's invoice must include a separate line item for each subparagraph in the Basis of 
Payment provision, and must show all applicable Task Authorization numbers. 
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(c) By submitting invoices, the Contractor is certifying that the goods and services have been 
delivered and that all charges are in accordance with the Basis of Payment provision of the 
Contract, including any charges for work performed by subcontractors. 


(d) The Contractor must provide the original of each invoice to the Technical Authority, and a copy to 
the Contracting Authority. 
11. Certifications and Additional Information 


(a) Unless specified otherwise, the continuous compliance with the certifications provided by the 
Contractor in its bid or precedent to contract award, any TA quotation and the ongoing 
cooperation in providing additional information are conditions of the Contract and failure to 
comply will constitute the Contractor in default. Certifications are subject to verification by Canada 
during the entire Contract Period. 


12. Federal Contractors Program for Employment Equity - Default by Contractor 


The Contractor understands and agrees that, when an Agreement to Implement Employment Equity 
(AIEE) exists between the Contractor and Employment and Social Development Canada (ESDC)-Labour, 
the AIEE must remain valid during the entire period of the Contract. If the AIEE becomes invalid, the 
name of the Contractor will be added to the "FCF Limited Eligibility to Bid" list. The imposition of such a 
sanction by ESDC will constitute the Contractor in default as per the terms of the Contract. 

13. Applicable Laws 

The Contract must be interpreted and governed, and the relations between the parties determined, by the 
laws in force in Ontario. 

14. Priority of Documents 


If there is a discrepancy between the wording of any documents that appear on the following list, the 
wording of the document that first appears on the list has priority over the wording of any document that 
appears later on the list: 


(a) these Articles of Agreement, including any individual SACC clauses incorporated by reference in 
these Articles of Agreement; 


(b) Supplemental General Conditions, in the following order: 


(i) 4002 (2010-08-16), Supplemental General Conditions - Software Development or 
Modification Services; 


(il) 4008 (2008-12-12), Supplemental General Conditions - Personal Information. 
(c) General Conditions 2035 (2018-06-21), Higher Complexity - Services; 


(d) Annex A, Statement of Work, including its Appendices as follows: 
(i) Appendix A to Annex A - Tasking Assessment Procedure; 
(ii) Appendix B to Annex A - Task Authorization (TA) Form; 
(iii) Appendix C to Annex A - Resource Assessment Criteria and Response Table; 


(iv) Appendix D to Annex A - Certifications at the TA stage; 
(e) Annex B, Basis of Payment; 
(f) Annex C, Security Requirements Check List; 


(g) the validly issued Task Authorizations and any required certifications; and 
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(h) 


(b) 


the Contractor's bid dated May 8, 2020. 


Foreign Nationals (Canadian Contractor) 
SACC Manual clause A2000C (2006-06-16) Foreign Nationals (Canadian Contractor) 


Insurance Requirements 


Compliance with Insurance Requirements 


(i) 


(ii) 


(iii) 


The Contractor must comply with the insurance requirements specified in this Article. The 
Contractor must maintain the required insurance coverage for the duration of the 
Contract. Compliance with the insurance requirements does not release the Contractor 
from or reduce its liability under the Contract. 


The Contractor is responsible for deciding if additional insurance coverage is necessary 
to fulfill its obligation under the Contract and to ensure compliance with any applicable 
law. Any additional insurance coverage is at the Contractor's expense, and for its own 
benefit and protection. 


The Contractor should forward to the Contracting Authority within ten (10) days after the 
date of award of the Contract a Certificate of Insurance evidencing the insurance 
coverage. Coverage must be placed with an Insurer licensed to carry out business in 
Canada and the Certificate of Insurance must confirm that the insurance policy complying 
with the requirements is in force. If the Certificate of Insurance has not been completed 
and submitted as requested, the Contracting Authority will so inform the Contractor and 
provide the Contractor with a time frame within which to meet the requirement. Failure to 
comply with the request of the Contracting Authority and meet the requirement within the 
time period will constitute a default under the General Conditions. The Contractor must, 
if requested by the Contracting Authority, forward to Canada a certified true copy of all 
applicable insurance policies. 


Commercial General Liability Insurance 


(i) 


(ii) 


The Contractor must obtain Commercial General Liability Insurance, and maintain it in 
force throughout the duration of the Contract, in an amount usual for a contract of this 
nature, but for not less than $2,000,000 per accident or occurrence and in the annual 

aggregate. 


The Commercial General Liability policy must include the following: 


(A) Additional Insured: Canada is added as an additional insured, but only with 
respect to liability arising out of the Contractor's performance of the Contract. The 
interest of Canada should read as follows: Canada, as represented by Public 
Works and Government Services Canada. 


(B) Bodily Injury and Property Damage to third parties arising out of the operations of 
the Contractor. 


(C) Products and Completed Operations: Coverage for bodily injury or property 
damage arising out of goods or products manufactured, sold, handled, or 
distributed by the Contractor and/or arising out of operations that have been 
completed by the Contractor. 


(D) Personal Injury: While not limited to, the coverage must include Violation of 
Privacy, Libel and Slander, False Arrest, Detention or Imprisonment and 
Defamation of Character. 
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(c) 


17. 


(a) 


(E) Cross Liability/Separation of Insureds: Without increasing the limit of liability, the 
policy must protect all insured parties to the full extent of coverage provided. 
Further, the policy must apply to each Insured in the same manner and to the 
same extent as if a separate policy had been issued to each. 


(F) Blanket Contractual Liability: The policy must, on a blanket basis or by specific 


reference to the Contract, extend to assumed liabilities with respect to contractual 


provisions. 


(G) Employees and, if applicable, Volunteers must be included as Additional Insured. 


(H) Employers' Liability (or confirmation that all employees are covered by Worker's 
compensation (WSIB) or similar program) 


(I) Broad Form Property Damage including Completed Operations: Expands the 
Property Damage coverage to include certain losses that would otherwise be 
excluded by the standard care, custody or control exclusion found in a standard 


policy. 


(J) Notice of Cancellation: The Insurer will endeavour to provide the Contracting 
Authority thirty (30) days written notice of policy cancellation. 


(K) If the policy is written on a claims-made basis, coverage must be in place for a 
period of at least 12 months after the completion or termination of the Contract. 


(L) Owners' or Contractors’ Protective Liability: Covers the damages that the 
Contractor becomes legally obligated to pay arising out of the operations of a 
subcontractor. 


(M) Advertising Injury: While not limited to, the endorsement must include coverage 
for piracy or misappropriation of ideas, or infringement of copyright, trademark, 
title or slogan. 


Errors and Omissions Liability Insurance 


(i) The Contractor must obtain Errors and Omissions Liability (a.k.a. Professional Liability) 
insurance, and maintain it in force throughout the duration of the Contract, in an amount 
usual for a contract of this nature but for not less than $1,000,000 per loss and in the 
annual aggregate, inclusive of defence costs. 


(il) If the Professional Liability insurance is written on a claims-made basis, coverage must 
be in place for a period of at least 12 months after the completion or termination of the 
Contract. 

(iii) The following endorsement must be included: 


Notice of Cancellation: The Insurer will endeavour to provide the Contracting Authority 
thirty (30) days written notice of cancellation. 


Limitation of Liability - Information Management/Information Technology 


This section applies despite any other provision of the Contract and replaces the section of the 
general conditions entitled "Liability". Any reference in this section to damages caused by the 
Contractor also includes damages caused by its employees, as well as its subcontractors, 
agents, and representatives, and any of their employees. This section applies regardless of 
whether the claim is based in contract, tort, or another cause of action. The Contractor is not 
liable to Canada with respect to the performance of or failure to perform the Contract, except as 
described in this section and in any section of the Contract pre-establishing any liquidated 
damages. The Contractor is only liable for indirect, special or consequential damages to the 
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extent described in this Article, even if it has been made aware of the potential for those 
damages. 


(D First Party Liability: 


(i) The Contractor is fully liable for all damages to Canada, including indirect, special or 
consequential damages, caused by the Contractor's performance or failure to perform the 
Contract that relate to: 


(A) any infringement of intellectual property rights to the extent the Contractor 
breaches the section of the General Conditions entitled "Intellectual Property 
Infringement and Royalties"; 


(B) physical injury, including death. 


(ii) The Contractor is liable for all direct damages caused by the Contractor's performance or 
failure to perform the Contract affecting real or tangible personal property owned, 
possessed, or occupied by Canada. 


(iii) Each of the Parties is liable for all direct damages resulting from its breach of 
confidentiality under the Contract. Each of the Parties is also liable for all indirect, special 
or consequential damages in respect of its unauthorized disclosure of the other Party's 
trade secrets (or trade secrets of a third party provided by one Party to another under the 
Contract) relating to information technology. 


(iv) The Contractor is liable for all direct damages relating to any encumbrance or claim 
relating to any portion of the Work for which Canada has made any payment. This does 
not apply to encumbrances or claims relating to intellectual property rights, which are 
addressed under (i)(A) above. 


(V) The Contractor is also liable for any other direct damages to Canada caused by the 
Contractor's performance or failure to perform the Contract that relate to: 


(A) any breach of the warranty obligations under the Contract, up to the total amount 
paid by Canada (including any applicable taxes) for the goods and services 
affected by the breach of warranty; and 


(B) Any other direct damages, including all identifiable direct costs to Canada 
associated with re-procuring the Work from another party if the Contract is 
terminated either in whole or in part for default, up to an aggregate maximum for 
this subparagraph (B) of the greater of .75 times the total estimated cost 
(meaning the dollar amount shown on the first page of the Contract in the cell 
titled "Total Estimated Cost" or shown on each call-up, purchase order or other 
document used to order goods or services under this instrument), or 
$1,000,000.00. 


In any case, the total liability of the Contractor under subparagraph (v) will not 
exceed the total estimated cost (as defined above) for the Contract or 
$1,000,000.00, whichever is more. 


(vi) If Canada's records or data are harmed as a result of the Contractor's negligence or 
willful act, the Contractor's only liability is, at the Contractor's own expense, to restore 
Canada's records and data using the most recent back-up kept by Canada. Canada is 
responsible for maintaining an adequate back-up of its records and data. 


(C) Third Party Claims: 


(i) Regardless of whether a third party makes its claim against Canada or the Contractor, 
each Party agrees that it is liable for any damages that it causes to any third party in 
connection with the Contract as set out in a settlement agreement or as finally 
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18. 


(a) 


(b) 


(c) 


determined by a court of competent jurisdiction, where the court determines that the 
Parties are jointly and severally liable or that one Party is solely and directly liable to the 
third party. The amount of the liability will be the amount set out in the settlement 
agreement or determined by the court to have been the Party's portion of the damages to 
the third party. No settlement agreement is binding on a Party unless its authorized 
representative has approved the agreement in writing. 


(ii) If Canada is required, as a result of joint and several liability or joint and solidarily liable, 
to pay a third party in respect of damages caused by the Contractor, the Contractor must 
reimburse Canada by the amount finally determined by a court of competent jurisdiction 
to be the Contractor's portion of the damages to the third party. However, despite Sub- 
article (i), with respect to special, indirect, and consequential damages of third parties 
covered by this Section, the Contractor is only liable for reimbursing Canada for the 
Contractor's portion of those damages that Canada is required by a court to pay to a third 
party as a result of joint and several liability that relate to the infringement of a third 
party's intellectual property rights; physical injury of a third party, including death; 
damages affecting a third party's real or tangible personal property; liens or 
encumbrances on any portion of the Work; or breach of confidentiality. 


(iii) The Parties are only liable to one another for damages to third parties to the extent 
described in this Sub-article (c). 


Professional Services - General 


The Contractor must provide professional services on request as specified in this Contract. All 
resources provided by the Contractor must meet the qualifications described in the Contract 
(including those relating to previous experience, professional designation, education, language 
proficiency and security clearance) and must be competent to provide the required services by 
any delivery dates described in the Contract. 


If the Contractor fails to deliver any deliverable (excluding delivery of a specific individual) or 
complete any task described in the Contract on time, in addition to any other rights or remedies 
available to Canada under the Contract or the law, Canada may notify the Contractor of the 
deficiency, in which case the Contractor must submit a written plan to the Technical Authority 
within ten working days detailing the actions that the Contractor will undertake to remedy the 
deficiency. The Contractor must prepare and implement the plan at its own expense. 


In General Conditions 2035, the Article titled "Replacement of Specific Individuals" is deleted and 
the following applies instead: 


Replacement of Specific Individuals 


(i) If the Contractor is unable to provide the services of any specific individual identified in 
the Contract to perform the services, the Contractor must within five working days of 
having this knowledge, the individual's departure or failure to commence Work (or, if 
Canada has requested the replacement, within ten working days of Canada's notice of 
the requirement for a replacement) provide to the Contracting Authority: 


(A) the name, qualifications and experience of a proposed replacement immediately 
available for Work; and 


(B) security information on the proposed replacement as specified by Canada, if 
applicable. 


The replacement must have qualifications and experience that meet or exceed those 
obtained for the original resource. 
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19. 


(a) 


(b) 


20. 


(ii) Subject to an Excusable Delay, where Canada becomes aware that a specific individual 
identified under the Contract to provide services has not been provided or is not 
performing, the Contracting Authority may elect to: 


(A) exercise Canada's rights or remedies under the Contract or at law, including 
terminating the Contract in whole or in part for default under the Article titled 
"Default of the Contractor", or 


(B) assess the information provided under (c) (i) above or, if it has not yet been 
provided, require the Contractor to propose a replacement to be rated by the 
Technical Authority. The replacement must have qualifications and experience 
that are similar or exceed those obtained for the original resource and be 
acceptable to Canada. Upon assessment of the replacement, Canada may 
accept the replacement, exercise the rights in (ii) (A) above, or require another 
replacement in accordance with this sub-article (c). 


Where an Excusable Delay applies, Canada may require (c) (ii) (B) above instead of 
terminating under the "Excusable Delay” Article. An Excusable Delay does not include 
resource unavailability due to allocation of the resource to another Contract or project 
(including those for the Crown) being performed by the Contractor or any of its affiliates. 


(iii) The Contractor must not, in any event, allow performance of the Work by unauthorized 
replacement persons. The Contracting Authority may order that an original or 
replacement resource stop performing the Work. In such a case, the Contractor must 
immediately comply with the order. The fact that the Contracting Authority does not order 
a resource to stop performing the Work does not relieve the Contractor from its 
responsibility to meet the requirements of the Contract. 


(iv) The obligations in this article apply despite any changes that Canada may have made to 
the Client's operating environment. 


Safeguarding Electronic Media 


Before using them on Canada's equipment or sending them to Canada, the Contractor must use 
a regularly updated product to scan electronically all electronic media used to perform the Work 
for computer viruses and other coding intended to cause malfunctions. The Contractor must notify 
Canada if any electronic media used for the Work are found to contain computer viruses or other 
coding intended to cause malfunctions. 


If magnetically recorded information or documentation is damaged or lost while in the 
Contractor's care or at any time before it is delivered to Canada in accordance with the Contract, 
including accidental erasure, the Contractor must immediately replace it at its own expense. 


Reporting Requirements 


The Contractor must provide the following reports to the Contracting Authority at the following 
times: 


e Quarterly Task Authorization Usage Report 


In addition, the Contractor must provide the following reports to the Technical Authority: 


Defects, change requests and outstanding items tracking status reports; 

Monthly project progress reports; 

Guides, manuals, reports to be disseminated to various stakeholders as required; 
oynthesis report of facilitated meetings; 

Activity reports; and 


Part — Partie 2 of — de 2 / Page 18 of - de 103 


000019 


Contract No. - N° du contrat And. No. - N° de la modif. Buyer ID - Id de l'acheteur 
47419-198132/001/EL 606el 


e Conversation notes, design documentation, change management documentation, site 
inspection reports and other reports requested under the Task Authorization. 


21. Representations and Warranties 


The Contractor made statements regarding its own and its proposed resources' experience and expertise 
in its bid that resulted in the award of the Contract and the issuance of TA's. The Contractor represents 
and warrants that all those statements are true and acknowledges that Canada relied on those 
statements in awarding the Contract and adding work to it through TA's. The Contractor also represents 
and warrants that it has, and all its resources and subcontractors that perform the Work have, and at all 
times during the Contract Period they will have and maintain, the skills, qualifications, expertise and 
experience necessary to perform and manage the Work in accordance with the Contract, and that the 
Contractor (and any resources or subcontractors it uses) has previously performed similar services for 
other customers. 


22. Implementation 


(a) Implementation of Professional Services: If similar professional services are currently being 
provided by another supplier or by Canada's own personnel, the Contractor is responsible for 
ensuring that the transition to the professional services it provides under the Contract is 
completed in a way that does not disrupt Canada's operations or users, and does not result in 
any interim degradation to the timeliness or quality of service. The Contractor is solely 
responsible for any additional training required by its resources to perform the Work, and time 
spent by resources on that training or becoming familiar with the Client's environment must not be 
charged to Canada. The transition will be considered complete once the Contractor has 
demonstrated, to the satisfaction of the Technical Authority, that it is ready and able to carry out 
the Work. All costs associated with establishing itself to provide the professional services are the 
responsibility of the Contractor. 


23. Identification Protocol Responsibilities 


The Contractor will be responsible for ensuring that each of its agents, representatives or subcontractors 
(hereinafter referred to as Contractor Representatives) complies with the following self-identification 
requirements: 


(a) Contractor Representatives who attend a Government of Canada meeting (whether internal or 
external to Canada's offices) must identify themselves as Contractor Representatives prior to the 
commencement of the meeting, to ensure that each meeting participant is aware of the fact that 
the individual is not an employee of the Government of Canada; 


(b) During the performance of any Work at a Government of Canada site, each Contractor 
Representative must be clearly identified at all times as being a Contractor Representative; and 


(c) If a Contractor Representative requires the use of the Government of Canada's e-mail system in 
the performance of the Work, then the individual must clearly identify him or herself as an agent 
or subcontractor of the Contractor in all electronic mail in the signature block as well as under 
"Properties." This identification protocol must also be used in all other correspondence, 
communication, and documentation. 


(d) If Canada determines that the Contractor is in breach of any obligation stated in this Article, upon 
written notice from Canada the Contractor must submit a written action plan describing corrective 
measures it will implement to eliminate the recurrence of the problem. The Contractor will have 
five working days to deliver the action plan to the Client and the Contracting Authority, and twenty 
working days to rectify the underlying problem. 


(e) In addition to any other rights it has under the Contract, Canada may terminate the Contract for 
default if the corrective measures required of the Contractor described above are not met. 
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24. 


25. 
25.1 


25.2 


25.3 


25.4 


Use of individual protective equipment and Occupational Health and Safety (OHS) 
guidelines 


a. 


The Contractor must comply with Government of Canada onsite requirements in respect 
of individual Protective Pieces of Equipment (PPE) and adhere to Occupational Health 
and Safety (OHS) guidelines in force in the workplace. 


The Contractor will provide its resources the following individual PPE for working on site: 
prescribed face covering mask, gloves, and anything else that is required as a pre- 
requisite to entry and to work on Government of Canada premises. Canada reserves the 
right to modify the list of PPE and OHS guidelines, if required, to include any future 
recommendations proposed by the Public Health Agencies. 


The Contractor warrants that its resources will wear the PPE mentioned above when 
onsite and follow at all times the Occupational Health and Safety (OHS) guidelines in 
force in the workplace during the contract period. If resources are not wearing the 
prescribed PPE and/or are not following the Occupational Health and Safety (OHS) 
guidelines in force in the workplace, they will not be permitted access to government of 
Canada sites. 


Dispute Resolution 


The parties agree to maintain open and honest communication about the Work throughout and 


after the performance of the contract. 


The parties agree to consult and co-operate with each other in the furtherance of the contract and 


promptly notify the other party or parties and attempt to resolve problems or differences that may 


arise. 


If the parties cannot resolve a dispute through consultation and cooperation, the parties agree to 
consult a neutral third party offering alternative dispute resolution services to attempt to address 


the dispute. 


Options of alternative dispute resolution services can be found on Canada's Buy and Sell website 
under the heading “Dispute Resolution”. 
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ANNEX A 
STATEMENT OF WORK 


1.0 Title 
Informatics Professional Services for Canada Border Services Agency 
Protected B Cloud Engineering - National Capital Region (NCR) 


2.0 Objective 


The Information, Science and Technology Branch (ISTB) of the Canada Border Services Agency (CBSA) 
requires the services of senior Informatics Professional resources with knowledge and experience 
supporting and assisting with Protected B compliant Cloud Engineering, Architecture, Deployment, 
Security and System Administration, in accordance with the Government of Canada Security Control 


Bie for Cloud- based GC Services 7 S ow, canada. caren government'systemdio : ta 
ina-tech | g ` i 


cloud- based-it-services. htmHitoc4), 


The purpose of these services is to augment and advise departmental resources in the execution of 
departmental IM/IT cloud initiatives managed by the Information, Science and Technology Branch (ISTB) 
team. 


3.0 Background 


CBSA is responsible for providing integrated services supporting national security and public safety 
priorities while facilitating the free flow of people and goods. Information technology is key to meeting the 
Agency's obligation to administer over 90 acts, regulations and international agreements, as well as 
deliver on the CBSA's commitments to modernization and renewal within its CBSA Renewal Agenda. 


ISTB provides delivery of technology products, applications and services to meet business needs while 
investing in modern IT infrastructure to maintain, build on and innovate current and future IM/IT Agency 
initiatives. 


One initiative led by the Information Services and Technology Branch (ISTB) under the Renewal umbrella 
includes reducing outages and disruptions, streamlining the number of applications and systems we use, 
replacing or upgrading aging equipment, and reducing maintenance and costs. Another significant aspect 
of CBSA Renewal includes building innovation capacity. In partnership with the Chief Transformation 
Officer Branch and business line branches, the ISTB will play a major role in executing rapid innovation in 
Border technology. 


The Agency has over 180 national applications primarily hosted on SSC-managed IT infrastructure. An 
important quantity of those applications use dated technology, including mainframe and specialized 
COTS, and are affected by SSC's Workload Migration initiative to consolidate and modernize their Data 
Centers. 


As part of an initiative entitled Application Modernization, to reduce dependencies on SSC-managed IT 
infrastructure in addition to renewing or refreshing its critical national applications, ISTB is currently 
working on a phased approach to leverage innovative technologies and initiate the migration of its 
applications to a modern hosting environment based in the cloud. Due to the quantities of personal and 
other sensitive data collected and used by CBSA to achieve its mandate, security and protection are an 
important concern. 
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In the Summer of 2019, CBSA approved its Cloud Strategy under the Application Modernization initiative 
(see Figure 1). Phase 0 of this Strategy is currently underway and involves the establishment of a cloud 
‘landing zone’, planning for subsequent phases and a pilot of a non-production migration activity. This is 
expected to be completed by March 2020. Phase 1 will build on the work of Phase 0, ensure the 
completion, integrity and security of the infrastructure, establish toolsets, processes and procedures and 
conduct the work to architect and migrate applications and data to the production Protected B compliant 
cloud. 


A target of twenty-five percent of CBSA's existing national applications must be migrated to the cloud by 
the end of March 2022. Modernizing CBSA applications and moving them to the cloud will deliver 
numerous benefits to the Agency and for the security of the country, including: 


e Reducing the risk and lower the cost/level of effort of migrating CBSA's systems to Enterprise 
Data Centres as part of SSC's Workload Migration project 

e Modernizing legacy applications will allow the Agency to reduce its risk of exposure to 
unsupported technology for which finding expertise is extremely challenging (reduces technical 
debt) 

e Attracting talent to the Agency and enabling our workforce to work smarter 

e Optimizing our processes and tools 


4.0 Scope of the Work 


The Contractor must provide informatics professional services on an as and when required basis in the 
National Capital Region (NCR) as initiated through Task Authorizations. Projects may be in any of the 
following stages: inception, identification, in the midst of work, or delivery. 


The Contractor is required to assist CBSA in deploying and maintaining a comprehensive application 
development and hosting environment in the Public Cloud meeting Protected B security requirements as 
per Treasury Board Guidelines available at htips:/^www.canada.ca/en/aovernment/svstem/diaital- 
aovernment/modern-emerdina-Technoioadies/cloud-services/government-canada-secutritv-coniroi-profile- 
cioud-based-it-services AIM. 


The Contractor will facilitate and perform the following cloud-based activities: 


e install and configure virtual private clouds, virtual networks, firewalls, application gateways, load 
balancers, security groups and other network infrastructure as required; 

e deploy and operate compute, storage, and other computing infrastructure; 

e establish toolsets and processes supporting cloud development and operations; 

e prepare and maintain platform and software-based services to allow the development, testing 

and migration of applications in the departmental cloud environment; 

analyze, classify, architect (or re-architect) and integrate the solutions and services required; 

ensure the security of the infrastructure, platform(s), services, applications and data; 

ensure the security and integrity of identity and authorization credentials; 

facilitate the selection, preparation and migration of legacy applications and data (as required) to 

the cloud environment; and 

e support the transition of cloud applications into an operational state and provide guidance and 
mentoring to CBSA staff within their areas of expertise. 


5.0 Resource-Specific Tasks 


Tasks will include, but are not limited to the following: 
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5.0.1 


5.0.2 


1.6. Network Analyst 


Prepare implementation plans for cloud technologies; 

Document cloud network configurations and settings; 

Prepare and analyze the detailed network system requirements including identification and 
sizing of resources, technical dependencies, support software/tools, interfaces, peak and 
normal performance metrics, redundancy, etc.; 

Contribute to the development of network architectures models; layer-2, layer-3 and layer-4; 
Install and configure Next Generation* firewalls in the provisioned cloud execution 
environments; 

Create networking/routing configuration and intrusion detection/prevention; 

Establish the protected B compliant networking foundation for a successful production 
workload migration to the cloud with connectivity to on-premises data centres; 

Utilize network monitoring tools; firewall, anti-malware and packet analyzers to support a 
secure Agency posture in the cloud, in accordance with Treasury Board's guidelines; 
Implement and support virtual environments; 

Troubleshoot network problem determination and resolution; 

Assist in interactive security debugging, testing and analysis of security attacks and system 
failures; 

Facilitate and guide the Agency in the planning, design and deployment of networking 
infrastructure, perimeter security and other services required to migrate, test and activate 
applications in the cloud; 

Employ Infrastructure as Code approaches to automate and deploy the provisioning and 
management of infrastructure resources; 

Monitor and stabilize particular facets of cloud platforms technology; 

Configure and optimize technical cloud platforms installations; 

Troubleshoot and respond to user problems; 

Perform impact analysis on cloud technology changes; 

Prepare and conduct testing strategies, scripts and prepare reports; 

Enforce and monitor security; and 

Develop scripts and templates to reflect current network configuration and topology to allow 
for the automated redeployment and repair of network infrastructure. 


1.7 Platform Analyst 


Identify cloud adoption approaches; 

Develop and document detailed assessments and configurations for identity management 
platforms that function compatibly both with the cloud service provider platform and CBSA's 
on-premises technologies, including mainframe and active directory; 

Analyze functional requirements to identify procedures and decision flows when it comes to 
identity management and federation in the cloud; 


Prepare and analyze the detailed application system requirements including identification and 
sizing of resources, virtualization, technical dependencies, interfaces, loads, peak and normal 


performance metrics, software, storage, redundancy etc.; 
Implement the latest security and identity management standards supporting a secure cloud 
implementation; 
Conduct design and application development work as required; 
Deploy biometric security models and multi-factor authentication and secure enclave 
processing; 
Develop security and identity management systems and methods for: 
o generating passwords using key inputs and contextual inputs; 
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5.0.3 


o authenticating a security device; 

o establishing trusted communication using a security device 
Define input/output sources, including detailed plan for technical design phase, and obtain 
approval for system proposals; 
Design cloud data structures and files, sub-systems and modules, programs, workloads, 
server-less apps, batch, on line, and production monitoring procedures; 
Develop testing strategies, scripts and testing reports; 
Document cloud system design, concepts and facilities, present and obtain approval of 
detailed system designs; 
Produce operational cloud identity management applications and documentation including all 
forms, manuals, programs, data files and procedures; 
Develop and prepare development environments including CI/CD pipelines; 
Perform solution integration activities supporting multi-cloud and hybrid solutions; 
Prepare and test implementation plans for cloud technologies, workloads and services; 
Install, monitor and stabilize particular facets of cloud platforms technology; 
Configure and optimize technical cloud platforms installations; 
Work with the System Administrator to develop and test automated rebuild procedures; and 
Identify typical ongoing operational support requirements following migration — day-to-day 
operations processes, integration and migration of additional workloads, data, maintenance, 
security procedures, compliance monitoring, inventory auditing, change management, 
account auditing and review, automated resource discovery, and system hardening etc. 


1.9 System Administrator 


Prepare and analyze detailed computing infrastructure system requirements including 
identification and sizing of resources, virtualization, technical dependencies, interfaces, loads, 
peak and normal performance metrics, software, storage, redundancy, system logs, security 
etc.; 

Install, monitor and stabilize particular facets of cloud platforms technology; 

Configure and optimize technical cloud platforms installations; 

Perform general administration duties including permissions, upgrades, and patches on 
provisioned cloud systems; 

Work with the Platform Analyst to develop and test automated rebuild procedures; 

Test and implement backup and restore services and procedures; 

Test and implement failover services for high availability workloads; 

Perform system monitoring, analysis, and performance tuning in the cloud; 

Guide and support various teams with onboarding, troubleshooting and resolution of 
implementation issues; 

Collaborate as necessary, research and resolve security issues and system failures; 

Script and automate administrative tasks, resources and services in the cloud or hybrid service 
environments; 

Define and implement policies for cloud-based systems; 

Identify opportunities to reduce costs of cloud provisioned resources and services; 
Collaborate with Cloud Architects and others, providing feedback and implementing their 
conceptual, logical or physical designs or architectures; 

Mentor support and technical staff on the provisioning, administration and maintenance plans 
for both production and other cloud environments; 

Develop and execute quality assurance, performance, recoverability and failover tests on newly 
provisioned cloud environments and report the results; 

Design the structure of build books that are to contain a detailed and current configuration of 
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5.0.4 


5.0.5 


the environment, history of changes, operations schedule, rebuild and resource provisioning 
procedures; 

Maintain build books to ensure they reflect the current and complete configuration of the 
environment; 

Create and maintain play books containing scripts and templates to automate recovery, 
updates, rollbacks, etc.; 

Periodically perform spot-checks to validate that provisioned resources align with build books; 
Coordinate system service schedule with other lines of support and produce schedule for 
software, firmware updates, upgrades and or replacement of virtual hosting instances in the 
cloud; 

Enforce and monitor security; 

Maintain and administer service desk problem ticketing system; 

Monitor Cloud environment security posture; 

Monitor environment and application performance, generate metrics, and create dashboards; 
Prepare environment cost models and reports; 

Conduct compliance monitoring, inventory auditing, change management, account auditing 
and review, automated resource discovery, system hardening; 

Administer Operating System (OS) and application patching procedures; and 

Identify typical ongoing operational support requirements- day-to-day operations and 
troubleshooting processes, provisioning, maintenance, and security procedures, etc. 


1.10 Technical Architect (Cloud Security) 


Capture and analyze Business Security Requirements; 

Define Technical and Functional requirements; 

Develop technical security architectures, frameworks and strategies to meet the business and 
application requirements; 

Identify security policies and requirements that drive out a particular solution; 

Analyze and evaluate alternative technology solutions to meet business problems and reduce 
risk with a particular focus on cloud technologies; 

Evaluate hardware and software relative to their ability to support specified requirements; 
Review computer software systems, security controls and data requirements; 

Conduct security architecture and design reviews and provide advice; 

Participate in security code reviews and penetration testing; 

Prepare Threat & Risk Assessments and other certifications and/or assessments as required; 
and 

Prepare and review other security documentation as required. 


1.11 Technology Architect 


Conduct inventory of current CBSA environment, including workloads, services, data, 
network and infrastructure deployed; 

Conduct cloud assessments and analysis of workloads and services to determine which 
workloads are good candidates for migration; 

Map source environment resources/services to target cloud resource/service; 

Define and design appropriate to-be application, platforms, and hosting architectures in public 
clouds with connectivity to on-premises data centres; 

Conduct sizing activities; 
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5.0.6 


5.0.7 


Design cloud architecture that meets key non-functional requirements (security, compliance, 
performance, resiliency, and availability); 

Oversee the migration of workloads and capabilities (e.g. Disaster recovery, archiving and 
backup) to cloud; 

Leverage cloud specific services (e.g. Web Application PaaS, Resource Manager, etc.) to 
implement desired cloud operating models and enable DevOps capabilities; 

Develop and document the proposed short and medium term cloud strategy for the 
selective migration to cloud services or alternative IT service delivery platforms; 

Ensure the integration of all aspects of cloud technology solutions; 

Provide support to applications and technical support teams in the proper application of 
existing infrastructure; 

Identify key issues that can be addressed and benefits that could be achieved with a 
selective migration to cloud services or alternative IT service delivery platforms; 

Design, document, and automate security and vulnerability incident response procedures; 
Design, document, and automate vulnerability assessment procedures; and 

Design, document, and automate OS and application patching and update procedures. 


B.2 Business Architect 


Develop policies and rules that allow CBSA to carry out its mandate and functional 
responsibilities, and that govern its actual and planned capabilities in terms of computers, 
data, information, human resources, communication facilities, software and management 
responsibilities relative to Cloud computing; 

Develop the specifications for where, how and why the various organizational components fit 
together as they do, and how they support the CBSA's mandate; 

Lead day-to-day activities of transformation initiatives; 

Assess transformation initiative impacts on job roles and organization structures; and 

Make recommendations as to the best use of public funds 


A.1 Application/Software Architect (Cloud Solutions) 


Create the conceptual, logical and physical designs for application architectures and their 
interoperability when hosted in a public cloud environment; 

Research, analyze, recommend and select technical approaches to address challenging 
development and integration problems with application architectures hosted within the public 
cloud environment; 

Develop implementation plans for the deployment of application architectures within the 
public cloud environment; 

Develop deployment strategies for architectures in the cloud that include secure remote 
access such as VPN gateways (client to gateway, gateway to gateway); 

Develop deployment strategies for cloud application architectures that include load balancing 
to ensure scalable performance; 

Develop deployment strategies for cloud architectures that include private networks for the 
storage and processing of more sensitive data; 

Develop deployment strategies for architectures of re-usable environments designed to test 
new data operations without affecting production usage; 

Provide guidance on how to limit the cost to the organization of cloud operations (scalability, 
filtering data before transmit etc.); 

Incorporate serverless design in application architectures; 
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5.0.8 


5.0.9 


Design High Availability (accessible most of the time 9996 7/24 365 days per year) elastic 
cloud services and applications using infrastructure as code; 

Design database-as-a-service solutions; 

Design scaling sets of virtual machines to keep costs low while still providing acceptable 
response times during peak usage; 

Design cloud-based authentication solutions allowing for single sign-on (SSO) among 
applications; and 

Design cloud-based authentication solutions that implement multi-factor authentication. 


A.7 Programmer/Analyst 


Create the conceptual, logical and physical designs for applications and their interoperability 
when hosted in a public cloud environment; 

Research, analyze, recommend and select technical approaches to address challenging 
development and integration problems with application architectures hosted within the public 
cloud environment; 

Provide guidance on how to limit the cost to the organization of cloud operations (scalability, 
filtering data before transmit etc.); 

Incorporate serverless design in application architectures; 

Design, develop and deploy highly available, elastic cloud services and applications using 
infrastructure as code; 

Design, develop and deploy database-as-a-service solutions; 

Review and analyze traffic flows and design and implement scaling parameters of 
infrastructure resources to keep costs low while still providing acceptable response times 
during peak usage; 

Design, develop and deploy cloud-based solutions that implement multi-factor authentication; 
and 

Develop testing scenarios, scripts and participate in testing, as required, to ensure quality, 
performance and security. 


Data Conversion Specialist (Cloud Data Scientist) 


Research, analyze, recommend and select advanced technical and scientific data approaches 
to address challenging business issues; 

Collaborate on the development of implementation plans for the migration and deployment of 
appropriate solutions for accessing legacy data in the public cloud environment; 

Collaborate on the development of deployment strategies for architectures of re-usable 
environments designed to test new data operations without affecting production usage; 
Perform data cleansing, exploratory data analysis, trend analysis, develop predictive models 
and test their algorithms, conduct rapid prototyping and present creative ideas to exploit data 
to drive deeper insights and business value; 

Identify areas for improvement and optimization with the goal of increasing value, developing 
knowledge and insight into and derived from Big Data used by the organization; 

Translate departmental issues and business needs into reporting and/or application 
requirements in order to develop and design solutions; 

Analyze large structured and unstructured datasets involving a wide range of systems across 
multiple disparate data sets; 

Develop data analytic / visualization plans to support high-quality, fact-based business 
decisions; 

Develop models that can be used in analytic pipelines to make predictions for use in risk 
assessment; 
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e Complete mapping, interfaces, mock conversion work, enhancements, actual conversion, and 
verify completeness and accuracy of converted data; 

e Establish a strong working relationship with all clients, interact effectively with all levels of 
client personnel, and provide conversion support; 

e Analyze and coordinate data file conversions; and 

e Work to import files from heterogeneous platforms. 


5.0.10 1.1 Data Conversion Specialist (Cloud Data Migration) 


5.0.11 


e Research, analyze, recommend and select technical approaches to address challenging 
application data issues for applications in the public cloud environment; 

e Provide guidance on how to limit the cost to the organization of cloud operations (scalability, 
filtering data before transmit etc.); 

e Collaborate on the development of implementation plans for appropriate solutions to the 
transformation and migration of or access to legacy data in the public cloud environment; 

e Collaborate on the development of deployment strategies for cloud application architectures 

that include storage solutions and load balancing to ensure scalable performance; 

Develop innovative solutions to complex business and technology problems; 

Plan, develop and execute data migration strategies; 

Help design and implement cloud architectures and configurations; 

Collaborate with other architects to design and build solutions to migrate existing applications 

and their databases from an in-premise Data Center to a secure cloud environment; 

e Analyze current Mainframe and UNIX/LINUX databases and their environments (DB2 and 
Sybase), evaluate and plan migrations to a cloud-based database platform and/or design 
hybrid distributed database solutions for reliability and cost containment; 

e Work with large scale databases (250+ GB); 

e Work with data migration tools and develop and enhance PL/SQL scripts to migrate from 
source database to target database; 

e Identity workarounds for specific issues, discrepancies and other scenarios observed during 
migration; 

e Automate solutions for repeatable operational activities and procedures; 

e Develop test plan and test cases to demonstrate database readiness and synchronization post 
migration; 

e Work closely with application teams to ensure business functionality and SLAs are met; 

e Consult for optimal design of database environments, analyze complex distributed production 
deployments, and make recommendations to optimize performance and manage costs; 

e Develop and conduct quality and integrity tests to validate all aspects of the data pre and post- 
migration; and 

e Conduct technical sessions for internal teams. 


C.11-Information Technology Security Vulnerability Analysis Specialist (Cloud) 


e Use industry-standard IT Security risk assessment methodologies to evaluate proposed 
architecture; 

e Work with architects, application developers, database professionals and others as necessary 
to design, test and deploy robust secure cloud applications; 

e Participate in the evaluation, research and development of IT Cloud security risk assessments, 
security tools and implementation plans; 

e Identify critical flaws in applications and systems that cyber attackers could exploit; 

e Identify threats to, and technical vulnerabilities of networks and other infrastructure; 
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5.1 


Conduct vulnerability assessments for networks, applications, databases and operating 
systems in the cloud environment; and 

Document findings and provide advice relevant to improving the security and integrity of the 
applications. 


Common Tasks for All Resource Categories 


Other common tasks may include, but are not limited to the following: 


6.0 


Review the most recent GC, Treasury Board Secretariat (TBS) and SSC cloud services 
guidelines relating to network security, and other related documents available at that time; 
Maintain up to date knowledge of particular technologies and products supporting cloud 
technology by keeping relevant cloud qualifications up to date when new products are deployed; 
Monitor industry trends to ensure that the departmental cloud implementation fit with government 
and industry directions for cloud technology; 

Plan and coordinate IM/IT project management activities for cloud adoption including all aspects 
of planning/coordination/guidance and process; 

Provide IM/IT documentation such as Statement of Requirements (SOR), project plans, feasibility 
reports, schedules, project management plans, risk management plans and lessons learned; 
Formulate and manage the IM/IT project plans by defining deliverables, identifying and providing 
resources, identifying key milestones, reviewing project progress against milestones, and 
engaging ongoing risk management; 

Develop and maintain systems for the management and control of IM/IT requirements on projects 
in a manner compatible with client standards and guidelines. This includes communications and 
consultations with various stakeholders in the process; 

Support the Technical Authority to oversee IM/IT cloud initiatives and various IM/IT initiatives; 
Support the Technical Authority to oversee the cloud change management process for IM/IT 
requirements; 

Provide monthly project progress reports; 

Coach and mentor teams' members and users on best practices and provide knowledge transfer; 
Conduct stakeholder meetings; and 

Prepare input to presentations and executive briefings. 


Deliverables 


The Contractor must provide the following deliverables as specified in the Task Authorization, which can 
include, but are not limited to: 


Metrics; 

Processes and procedures for systems and applications; 
Conceptual architecture design; 

Technical design documents; 

Networking configuration; 

Architecture design specification; 

oystem requirements; 

Build books; 

Data flow diagrams; 

oystem controls; 

Test strategies; 

Test plans; 

Defects, change requests and outstanding items tracking status reports; 


Part — Partie 2 of — de 2 / Page 29 of - de 103 


000030 


Contract No. - N° du contrat And. No. - N° de la modif. Buyer ID - Id de l'acheteur 
47419-198132/001/EL 606el 


Standard operating procedures guides; 

Architectural diagrams; 

Frameworks; 

Impact analysis and strategies; 

Candidate design; 

Technical design document; 

Project plans; 

Analysis documents; 

Requirements studies; 

Options analysis; 

Conceptual system design; 

Technical design document; 

otrategy and roadmap for the departments migration to the recommended cloud services 

environments; 

e Recommendations of short and medium term target environments for application systems 
and workloads; 

e Protected B compliant network design and automated scripts; 

e Operating System Hardening standards for Cloud; 

Deployment and configuration of infrastructure components facilitating production workload 

hosting in the Public Cloud accounts managed by the CBSA; 

Written and verbal advice; 

Knowledge transfer; 

Issues papers and Briefing Notes; 

Presentation decks and materials; 

Meeting facilitation and reports (e.g. monthly progress reports); 

Guides, manuals, reports to be disseminated to various stakeholders as required; 

Meeting agendas, schedules and minutes; 

synthesis report of facilitated meetings; 

Activity reports; 

Conversation notes, design documentation, change management documentation, site 

inspection reports and other work requested under the Task Authorization; and 

e Prototypes, scripts, templates and code. 


Deliverables must be submitted in hard and soft copies in the appropriate formats (e.g. MS Project or MS 
Office Suite applications) as identified in the TA. All electronic deliverables must comply with 
departmental software standards, currently MS Office Suite latest version. Where required, CBSA will 
provide the Contractor with the required forms and templates to meet these standards. 


All documents developed or updated by each of the Contractor’s resources must be provided to the 
Project Authority for review, approval and signature (as required). 


7.0 Constraints 

The Contractor will be expected to maintain up to date knowledge of relevant technologies and products 
supporting cloud technology by keeping relevant cloud qualifications up to date when new products are 

deployed. 

All aspects of the Cloud infrastructure, applications and services designed and implemented must meet 


the latest Government Protected B Medium Integrity, Medium Availability security profile requirements, 
and Treasury Board Secretariat (TBS) and SSC cloud services guidelines. 
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The Government of Canada strives to ensure that the goods and services it procures are inclusive by 
design and accessible by default, in accordance with the Accessible Canada Act, its associated 
regulations and standards, and Treasury Board Contracting Policy. The following accessibility standards 
are applicable to this requirement. 


e Accessibility for Ontarians with Disabilities Act (AODA) - Accessible Customer Service Standard 
e [own of East Gwillimbury - Accessibility Standards for Customer Service 


8.0 Client Support 


The Client will provide all documentation and information necessary for the Work. 


9.0 Language Requirements 

While proposed resources must be fluent in English, there may be a requirement for specific resources to 
be fluent in both official languages, which will be specified in the TA. 

10.0 Work Location 


The Contractor's resources will be required to work onsite at CBSA premises or project site locations in 
the NCR, which will be identified in the Task Authorization (TA). 


CBSA will provide, subject to security requirements, and only to the specified resource personnel, access 
to identified databases or applications residing on CBSA computers or networks for the sole purpose of 
executing tasks associated with this Contract. CBSA, at its sole discretion, will identify the nature and 
characteristics of such access. 

11.0 Travel 

The Contractor personnel may be required to travel outside the National Capital region to perform 
assigned work. All travel will require prior written approval of the Project Authority or the designated 
representative. The Contractor must ensure that travel is authorized in accordance with the current 
Nallonal Joint Council Travel Directive. Travel within the NCR is the responsibility of the Contractor. 


Travel outside of Canada may also be involved, and a valid passport will be required. 
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Figure 1: CBSA Application Modernization 
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APPENDIX A TO ANNEX A 
TASKING ASSESSMENT PROCEDURE 


Where a requirement for a specific task is identified, a draft Task Authorization Form (TA Form) 
as attached at Appendix B to Annex A will be provided to the Contractor. Once a draft TA Form is 
received, the Contractor must submit to the Technical Authority a quotation of rates to supply the 
requested Resource Categories based on the information identified in the TA Form, as well as its 
corresponding proposed resource(s). The quotation must be signed and submitted to Canada 
within the time for response identified in the TA Form. The Contractor will be given a minimum of 
2 working days (or any longer time period specified in the draft TA) turnaround time to submit a 
quotation. 


With each quotation the Contractor must propose the required number of resources and for each 
proposed resource the Contractor must supply a résumé, the requested security clearance 
information and must complete the Response Tables at Appendix C of Annex A applicable to the 
Resource Categories identified in the draft TA. The same individual must not be proposed for 
more than one Resource Category. The résumés must demonstrate that each proposed 
individual meets the qualification requirements described (including any educational 
requirements, work experience requirements, and professional designation or membership 
requirements). With respect to the proposed resources: 


(i) Proposed resources may be employees of the Contractor or employees of a 
subcontractor, or these individuals may be independent contractors to whom the 
Contractor would subcontract a portion of the Work. (Refer to Appendix D to Annex A, 
Certifications). 


(ii) For educational requirements for a particular degree, designation or certificate, Canada 
will only consider educational programmes that were successfully completed by the 
resource before the date the draft TA was first issued to the Contractor. 


(iii) For requirements relating to professional designation or membership, the resource must 
have the required designation or membership by the time of draft TA issuance and must 
continue, where applicable, to be a member in good standing of the profession or 
membership throughout the assessment period and Contract Period. Where the 
designation or membership must be demonstrated through a certification, diploma or 
degree, such document must be current, valid and issued by the entity specified in this 
Contract or if the entity is not specified, the issuer must have been an accredited or 
otherwise recognized body, institution or entity at the time the document was issued. 


(iv) For work experience, Canada will not consider experience gained as part of an 
educational programme, except for experience gained through a formal co-operative 
programme at a post-secondary institution. 


(v) For any requirements that specify a particular time period (e.g., 2 years) of work 
experience, Canada will disregard any information about experience if the résumé does 
not include the relevant dates (month and year) for the experience claimed (i.e., the start 
date and end date). Canada will evaluate only the duration that the resource actually 
worked on a project or projects (from his or her start date to end date), instead of the 
overall start and end date of a project or a combination of projects in which a resource 
has participated. 


(vi) A résumé must not simply indicate the title of the individual's position, but must 
demonstrate that the resource has the required work experience by explaining the 
responsibilities and work performed by the individual while in that position. Only listing 
experience without providing any supporting data to describe responsibilities, duties and 
relevance to the requirement, or reusing the same wording as the TA Form, will not be 
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considered "demonstrated" for the purposes of the assessment. The Contractor should 
provide complete details as to where, when, month and year, and how, through which 
activities/responsibilities, the stated qualifications / experience were obtained. In 
situations in which a proposed resource worked at the same time on more than one 
project, the duration of any overlapping time period will be counted only once toward any 
requirements that relate to the individual's length of experience. 


3. The qualifications and experience of the proposed resources will be assessed against the 
requirements set out in Appendix C to Annex A to determine each proposed resource's 
compliance with the mandatory and rated criteria. Canada may request proof of successful 
completion of formal training, as well as reference information. Canada may conduct reference 
checks to verify the accuracy of the information provided. If reference checks are done, they will 
be conducted in writing by e-mail (unless the contact at the reference is only available by 
telephone). Canada will not assess any points or consider a mandatory criterion met unless the 
response is received within 5 working days. On the third working day after sending out the e- 
mails, if Canada has not received a response, Canada will notify the Contractor by e-mail, to 
allow the Contractor to contact its reference directly to ensure that it responds to Canada within 5 
working days. Wherever information provided by a reference differs from the information supplied 
by the Contractor, the information supplied by the reference will be the information assessed. 
Points will not be allocated or a mandatory criteria considered as met if the reference customer is 
not a customer of the Contractor itself (for example, the customer cannot be the customer of an 
affiliate of the Contractor). Nor will points be allocated or a mandatory criteria considered as met if 
the customer is itself an affiliate or other entity that does not deal at arm's length with the 
Contractor. Crown references will be accepted. 


4. During the assessment of the resources proposed, should the references for two or more 
resources required under that TA either be unavailable or fail to substantiate the required 
qualifications of the proposed resources to perform the required services, the Contractor's 
quotation may be found to be non-responsive. 


5. Only quotations that meet all of the mandatory criteria will be considered for assessment of the 
point rated criteria. Each resource proposed must attain the required minimum score for the point 
rated criteria for the applicable Resource Category. If the minimum score for any proposed 
resource is less than what is required, the Contractor's quotation will be found to be non- 
responsive. 


6. Once the quotation has been accepted by the Technical Authority, the TA Form will be signed by 
Canada and provided to the Contractor for signature. The TA Form must be appropriately signed 
by Canada prior to commencement of any work. The Contractor must not commence work until a 
validly issued TA Form (the Task Authorization) has been received, and any work performed in its 
absence is done at the Contractor's own risk. 
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APPENDIX B TO ANNEX A 
TASK AUTHORIZATION FORM 
(Provided under separate cover) 
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APPENDIX C TO ANNEX A 
RESOURCES ASSESSMENT CRITERIA AND RESPONSE TABLE 


To facilitate resource assessment, the Contractor must prepare and submit a response to a 
draft Task Authorization using the tables provided in this Annex. When completing the resource 
grids, the specific information which demonstrates the requested criteria and reference to the 
page number of the résumé should be incorporated so that Canada can verify this information. 
The tables should not contain all the project information from the resume. Only the specific 
answer should be provided. 


To demonstrate compliance with all criteria, the Contractor must include the following 
information: 


Project name; 

Client organization; 

Project start /end dates and duration; 

Project description; 

Description of role and tasks performed by the resource. 


The Contractor must also include the following information for the most recent project 
referenced in response to any of the criteria: 


e Contact information of client project representative 


The Contractor must provide the following information for projects referenced (other than the 
most recent) in response to any of the criteria upon request from CBSA: 


e Contact information of client project representative 


1.0 Mandatory Resource Assessment Criteria: 


NOTE TO CONTRACTOR: Where indicated by bold italics, those terms are defined within the Glossary. 
l.6 Network Analyst — Level 3 


Resource Category: 1.6 Network Analyst — Level 3 


Name of Proposed Resource: 


Criteria Mandatory Requirement Bidder's Response 


Demonstrated Insert 
experience page # of 
(Bidders to resume 
insert data) 


The Contractor MUST demonstrate that the Proposed MEN 
Resource has a minimum of ten (10) years' experience within 


Part — Partie 2 of — de 2 / Page 36 of - de 103 


000037 


Contract No. - N° du contrat And. No. - N° de la modif. Buyer ID - Id de l'acheteur 
47419-198132/001/EL 606el 


Resource Category: 1.6 Network Analyst — Level 3 


Name of Proposed Resource: 


Criteria Mandatory Requirement Bidder's Response 


Demonstrated Insert 
experience page # of 


(Bidders to resume 
insert data) 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of five (5) years' experience within 
the last eight (8) years designing and architecting 
Infrastructure solutions leveraging cloud technologies and 
services including all of the following: 


e Next Generation Firewalls 

e Virtual networks, subnets and User Defined Routing 
(UDR) 

Multi-Protocol Label Switching 

Security Groups 

Application gateways and load balancing 
Network failover 

Containers 

Elastic Computing 

otorage and backup 

Infrastructure as Code 


the last fifteen (15) years working on Enterprise-Class IT 
systems performing all of the following tasks: 
Documenting network configurations! and settings; 
Contributing to the development of OSI network 
architecture models; 
Installing and configuring Next-Generation firewalls; 
Performing networking/routing configuration? and 
intrusion detection/prevention; 
Utilizing network monitoring tools; firewall, anti- 
malware and packet analyzers; 
Supporting converged infrastructure and virtual 
environments; 
Automating network administration tasks via shell 
scripts; 
Troubleshooting network problems, issue 
determination and resolution; and 
Conducting and assisting in interactive security 
debugging, testing and analysis of security attacks 
and system failures. 
Note: To qualify, a project must have a minimum duration of 
six (6) months 


Part — Partie 2 of — de 2 / Page 37 of - de 103 


000038 


Contract No. - N° du contrat And. No. - N° de la modif. Buyer ID - Id de l'acheteur 
47419-198132/001/EL 606el 


Resource Category: 1.6 Network Analyst — Level 3 


Name of Proposed Resource: 


Criteria Mandatory Requirement Bidder's Response 


Demonstrated Insert 
experience page # of 


(Bidders to resume 
insert data) 


Note: To qualify, a project must have a minimum duration of 
six (6) months 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of eighteen (18) months experience 
within the past five (5) years deploying and configuring virtual 
networks, routing and Next Generation Firewalls supporting 
a Cloud environment designed to meet any of the following 
security control profiles: 

the Government of Canada Protected B Medium 

intearity Medium avallabilty (PBMMD Profile. 

FIDRAMP Moderate or sigh Level 


The Contractor MUST demonstrate that the Proposed 
Resource has one or more of the following certifications 
applicable to Infrastructure as a Service (laaS) platforms 
from one or more Leaders in the Gartner 2019 Magic 
Quadrant for laaS Cloud (i.e. AWS, Azure, or Google) 
e AWS Certified Advanced Networking Specialty 
e AWS Certified Solutions Architect Professional 
Microsoft Certified: Azure Administrator Associate 
AND Azure Enterprise-Class Networking Workshop 
elective OR MCSE: Cloud Platforms and 
Infrastructure 
Azure Solutions Architect Expert 
Professional Cloud Network Engineer (GCP) 
Professional Cloud Architect (GCP) 
A copy of the certification(s) must be provided with the 
bid. 
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1.7 Platform Analyst — Level 3 


Resource Category: 1.7 Platform Analyst — Level 3 


Name of proposed Resource: 


Criteria Mandatory Requirement Bidder's Response 
Demonstrated | Insert 
experience page # 


(Bidders to of 
insert data) resume 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of five (5) years' experience as a 
Platform Analyst performing analysis, detailed design, 
implementation and support of platform technologies for a 
large user base", of which: 


- 2 years involved critical* platform technologies; 
- 3 years involved cloud platform technologies. 


Note: Critical is defined as having High Availability (9996) 
service requirements. Large user base is defined as having 
3000 or more active users. 


Note: To qualify, a project must have a minimum duration of 
six (6) months 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of twelve (12) months' experience 
within the last five (5) years designing, implementing, 
developing or supporting platforms complying with at least 
four of the following security standards/requirements: 
OWASP Proactive Controls 

FIPS 140-2 

FIPS 186-4 


SOC 2 controls 
ISO 27001, (SO 27017 and iSO 27018 


Note: To qualify, a project must have a minimum duration 
of six (6) months. The experience can be demonstrated in 
various combinations of the listed standards/requirements 
across different projects, however the minimum twelve (12) 
months experience must be demonstrated for EACH 
security standard/requirement. 


Overlapping periods will count only once for each 
standard/requirement. 


The Contractor MUST demonstrate that the Proposed —] 
Resource has a minimum of twelve (12) months' experience 
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Resource Category: 1.7 Platform Analyst — Level 3 


Name of proposed Resource: 


Criteria Mandatory Requirement Bidder's Response 
Demonstrated | Insert 
experience page # 
(Bidders to of 
insert data) resume 


within the last five (5) years working with all of the following 
identity federation standards: 


e OpenID Connect and OAuth 2.0 or later 
e SAML 2.0 or later 


Note: To qualify, a project must have a minimum duration 
of six (6) months. The experience can be demonstrated in 
various combinations across different projects, however the 
minimum twelve (12) months experience must be 
demonstrated for EACH. 


Overlapping periods will count only once for each standard. 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of twelve (12) months’ experience 
within the last five (5) years implementing solutions 
involving Cloud-based identity access management, Multi- 
factor authentication AND one of the following; 

e Biometric security models 

e Secure enclave processing 
Note: To qualify, a project must have a minimum duration of 
six (6) months. The experience can be demonstrated in 
various combinations across different projects, however the 


minimum twelve (12) months experience must be 
demonstrated for EACH of the three requirements above. 


Overlapping periods will count only once for each 
standard/requirement. 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of twelve (12) months' experience 
within the last five (5) years deploying a Level of Assurance 
4 identity authentication solution for an organization with a 
user base of 3000 or more active users. 


Note: To qualify, a project must have a minimum duration of 
six (6) months. 
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1.9 System Administrator — Level 3 


Resource Category: 1.9 System Administrator — Level 3 


Name of proposed Resource: 


Bidder's Response 


Demonstrated | Insert 


Criteria Mandatory Requirement 
experience page # of 
(Bidders to resume 
insert data) 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of five (5) years’ experience 
within the last ten (10) years provisioning, administering 
and supporting all of the below infrastructure and services 
hosted on a public or private cloud service: 


Elastic Computing 

Virtual Appliances 

Storage 

Backup solutions 

User credentials 

Secure Remote Access 

Application gateways and load balancing 


Note: To qualify, a project must have a minimum duration 
of six (6) months. The experience can be demonstrated in 
various combinations across different projects, however 
the minimum five (5) years’ experience must be 
demonstrated for EACH one of the infrastructure and 
services listed above. 


Overlapping periods will count only once for each 
infrastructure and service. 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of three (3) years’ experience 
within the last ten (10) years performing all of the following 
tasks in a Cloud environment: 


e Performing general system administration duties 
including managing permissions, and installing 
upgrades and patches on public cloud systems; 
Installing and configuring software, resources and 
services; 

Performing system monitoring, analysis, and 
performance tuning; 

Configuring and managing secure connections 
between the client in-premise environments and 
the cloud; 

Investigating and resolving security issues; 
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Resource Category: 1.9 System Administrator — Level 3 


Name of proposed Resource: 


Criteria Mandatory Requirement 


Investigating and resolving application 
performance issues; and 
Scripting and automating tasks to manage 


resources and services in the cloud environments. 


Note: To qualify, a project must have a minimum duration 
of six (6) months 


The Contractor MUST demonstrate that the Proposed 
Resource has a minimum of five (5) years’ experience 
within the last ten (10) years performing all of the 
following tasks: 


e Collaborating with Cloud Architects, providing 
feedback and implementing conceptual, logical or 
physical designs or architectures; 


Developing and executing Quality Assurance tests 


on newly provisioned environments and recording 
and communicating the results; 

Performing system hardening on newly 
provisioned environments; 

Conducting compliance monitoring and inventory 
auditing; and 

Creating and maintaining structured and thorough 
Build Books that contain a detailed and current 
configuration! of the environment, with validated 
Rebuild and Provisioning Procedures. 


Note: To qualify, a project must have a minimum duration 
of six (6) months 
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Bidder's Response 


Demonstrated | Insert 
experience page # of 
(Bidders to resume 
insert data) 
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1.10 Technical Architect (Cloud Security) — Level 3 


Resource Category: 1.10 Technical Architect (Cloud Security) — Level 3 


Name of proposed Resource: 


Bidder's Response 


Demonstrate | Insert 


Mandatory Requirement 
Moses d experience | page # of 


(Bidders to resume 
insert data) 


The Contractor MUST demonstrate that the Proposed Resource 
has three (3) years' experience leading the Security Assessment 
and Authorization efforts within a North American public sector 
organization for the successful authorization of government 
Protected B (or equivalent)** cloud deployments. 


* Successful has the following characteristics: The cloud 
deployment has been designed with specific controls and to meet 
specific security requirements, has undergone assessment 
according to a recognized Security Assessment & Authorization 
process and received an Authority to Operate from the 
appropriate responsibility area. 


** "Protected B” data is defined as sensitive personally- 
identifiable private data which could be injurious to an individual 
or organization if compromised. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the Proposed Resource 
has five (5) years' experience, of which 3 years or more were 
within a Cloud environment, performing ALL of the following 
tasks: 


Defining Technical and Functional security requirements; 
Creating Security Architecture; 

Participating in Infrastructure and Application 
Architecture Reviews; 

Participating in Infrastructure and Application Design 
Reviews; and 

Performing IT Certification or Assessment activities. 


Note: To qualify, a project must have a minimum duration of three 
(3) months 


The Contractor MUST demonstrate that the proposed resource 
has any three (3) of the following certifications: 


e Certified Cloud Security Professional 
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Resource Category: 1.10 Technical Architect (Cloud Security) — Level 3 


Name of proposed Resource: 


Bidder's Response 
Criteria Mandatory Requirement Demonstrate | Insert 


d experience | page # of 
(Bidders to resume 
insert data) 


(PCI-QSA) 
oystem Security Certified Practitioner (SSCP) 


Certified Information System Security Professional 
(CISSP) 
Certified ISO 27001 Lead Implementer 
Certified Information Systems Auditor (CISA) 
Certified Information Security Manager (CISM) 
Certified in Risk and Information System Control (CRISC) 
Cloud Security Alliance Cloud Security Knowledge 
(CCSK) 
GIAC Industrial Cyber Security Professional (GICSP) 
Payment Card Industry — Qualified Security Assessor 
A Copy of the Certifications must be provided. 


1.11 Technology Architect — Level 3 
Resource Category: 1.11 Technology Architect — Level 3 


Name of proposed Resource: 


Bidder's Response 
Criteria Mandatory Requirement Demonstrate | Insert 


d experience | page # of 
(Bidders to resume 
insert data) 


Developing Logical and Physical cloud models; 
Developing and Implementing architectural strategies 
and plans; 

Contributing to overall project plans, testing strategies, 
security and infrastructure design; 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of ten (10) years' experience within the last 
fifteen (15) years working on Enterprise-class IT systems 
performing a minimum of six of the following tasks: 
Gathering and documenting business requirements; 
Developing Systems Architecture; 
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Resource Category: 1.11 Technology Architect — Level 3 


Name of proposed Resource: 


Bidder's Response 
Criteria Mandatory Requirement Demonstrate | Insert 
d experience | page # of 
(Bidders to resume 
insert data) 


Developing processes to enable the migration of data or 
workloads from source to destination systems; 
Contributing expertise and resolving Issues related to 
architectural challenges; and 

Reporting on progress to management using standard 
approaches and visualization (charts, etc.). 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of five (5) years' experience within the last eight 
(8) years designing and architecting infrastructure services or 
applications leveraging a minimum of five of the following cloud 
technologies: 

Elastic Computing 

Cloud storage and backup 

Networking (Firewalls, User Defined Routing) 

Application gateways and load balancing 

Database or DataWarehouse-as-a-Service 

Identity, Credential and Access Management 
Note: To qualify, each project must have a minimum duration of 
six (6) months 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of eighteen (18) months' experience in the last 
five (5) years (as of solicitation issue date) architecting and 
executing a solution to migrate an existing Enterprise-class 
secure* application or service to the cloud. 


*Secure is defined as meeting one of the following security 
control profiles: 
o the Government of Canada Protected B Medium 
intearity Medium availability (PBMN). 
O 


o [50 27001, [SO 27017 and ISO 27018 


Note: To qualify, a project must have a minimum duration of six 
(6) months 
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Resource Category: 1.11 Technology Architect — Level 3 


Name of proposed Resource: 


Bidder's Response 
Criteria Mandatory Requirement Demonstrate | Insert 


d experience | page # of 
(Bidders to resume 
insert data) 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of two (2) years' experience within the last ten 
(10) years (as of solicitation issue date) designing, developing 
(coding), testing, implementing and supporting application 
solutions. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the Proposed Resource 
has: 

One of the following certifications applicable to Infrastructure as a 
Service (laaS) platforms from one or more Leaders in the Gartner 


2019 Magic Quadrant for laaS Cloud (i.e. AWS, Azure, or 
Google): 


Azure Solutions Architect Expert 
Amazon Solutions Architect Associate 
Professional Cloud Architect (GCP) 


A copy of the certificate(s) must be provided with the bid. 


B.2 Business Architect — Level 3 
Resource Category: B.2 Business Architect — Level 3 


Name of proposed Resource: 


Bidder's Response 
Criteria Mandatory Requirement Demonstrate | Insert 


d experience | page # of 
The Contractor MUST demonstrate that the proposed resource 
has a minimum of ten (10) years' experience within the last 
fifteen (15) years performing all of the following tasks and 


(Bidders to resume 
insert data) 


activities for Large* organizations; 
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Resource Category: B.2 Business Architect — Level 3 


Name of proposed Resource: 


Bidder's Response 


Demonstrate | Insert 


Criteri Mandatory Requirement 
usd: lani d experience | page # of 


(Bidders to resume 
insert data) 


The Contractor MUST demonstrate that the proposed resource 
has worked on a minimum of two (2) projects in the last five (5) 
years : 


e Guiding and leading people, process and organizational 
change in response to disruptive forces or opportunities 
towards desired business outcomes by meeting with 


variety* of project stakeholders to help build awareness 
and secure buy-in for cross-organization initiatives and 
release readiness 


Working with domain architects (information, data, 
application) and solution architects to align technical 
design decisions with business needs and goals 


"Variety is defined as at least 3 different stakeholder groups 
(internal and/or external) 


Researching, defining and communicating the current 
business architecture for Information Technology service 
delivery using deliverables such as: Strategy Maps, 
Business Model Canvas, Value Chains, Business 
Capability Models, Business Process Models; 
Reviewing, Analyzing and evaluating emerging 
technologies, trends, business models and best practices 
to identify new services and delivery models that would 
better serve the clients or customers of the organization; 
Assessing an organizations' capacity and capability to 
undertake and deliver on an initiative or a change; and 
Researching, defining and communicating the value and 
Return on Investment (ROI) of proposed services and 
transformation initiatives through: Business Cases, Logic 
Models, Outcomes Registers, Benefits Realization Plans, 
and Key Performance Indicators (KPls). 

* Large organizations are defined as organizations having 2000 

or more employees OR organizations having 1500 or more 

employees and multiple lines of business each with separate 

organization structures and strategic objectives 

Note: To qualify, a project must have a minimum duration of six 

(6) months 
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Resource Category: B.2 Business Architect — Level 3 


Name of proposed Resource: 


Bidder's Response 


Demonstrate | Insert 

d experience | page # of 
(Bidders to resume 
insert data) 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Criteria Mandatory Requirement 


Resource Category: A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Name of proposed Resource: 


Contractor's Response 
Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 


(Contractors | resume 
to insert 
data) 


systems and between new and existing systems; and 
Define input/output sources, including detailed plan for 
technical design phase, and obtain approval of the 
system proposal. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


M7.1 The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of ten (10) years' experience* within the last 
fifteen (15) years performing all of the following tasks: 

Develop technical architectures, frameworks and 
strategies, to meet the business and application 
requirements; 

Analyze and evaluate alternative technology solutions to 
meet business problems; 

Ensure the integration of all aspects of technology 
solutions; 

Evaluate existing procedures and methods, identify and 
document database content, structure, and application 
sub-systems, and develop data dictionary; 

Define and document interfaces of manual to automated 
operations within application sub-systems, to external 
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Resource Category: A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Name of proposed Resource: 


Contractor's Response 
Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 


(Contractors | resume 


to insert 


data) 
M7.2 The Contractor MUST demonstrate that the proposed resource 
has a minimum of five (5) years' experience within the last ten 
(10) years performing all of the following tasks: 

e Performing requirements analysis, data profiling, effort 
estimation for database design and documenting the 
results; 

Translating complex technical terminology, concepts and 
Issues in terms understandable to technical and 
nontechnical management and resources staff; 
Developing and maintaining conceptual, logical, and 
physical diagrams of the applications, software, and 
database architectures for business critical applications; 
and 
Ensuring projects adhered to client's application, data, 
and database standards and policies 
Note: To qualify, a project must have a minimum duration of six 
(6) months 
M7.3 The Contractor MUST demonstrate that the proposed resource 
has a minimum of five (5) years’ experience within the last ten 
(10) years performing all of the following tasks within a public 
cloud environment: 
Creating the conceptual, logical and physical designs for 
application architectures and their interoperability; 
Researching, analyzing, recommending and selecting 
technical approaches to address challenging 
development and integration problems with application 
architectures; and 
Developing implementation plans for the deployment of 
application architectures. 
Note: To qualify, a project must have a minimum duration of six 
(6) months 
M7.4 The Contractor MUST demonstrate that the Proposed Resource NN NÉ 
has a minimum of three (3) years' experience within the last eight 


Part — Partie 2 of — de 2 / Page 49 of - de 103 


000050 


Contract No. - N° du contrat And. No. - N° de la modif. Buyer ID - Id de l'acheteur 
47419-198132/001/EL 606el 


Resource Category: A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Name of proposed Resource: 


Contractor's Response 
Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 
(Contractors | resume 
to insert 


(8) years designing and implementing cloud solutions employing 
5 or more of the following cloud technologies and services: 


Elastic Computing 

Cloud storage and backup 

Automation 

Network Virtual Appliances (Firewalls) 
Application gateways and load balancing 
Database-as-a-Service 

Identity, Credential and Access Management 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


M7.5 The Contractor MUST demonstrate that the proposed resource 
has a minimum of one (1) year experience designing and 
implementing cloud solutions for a public sector organization. 
Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the Proposed Resource 
has: 


One of the following certifications applicable to Infrastructure as a 
Service (laaS) platforms from one or more Leaders in the Gartner 
2019 Magic Quadrant for laaS Cloud (i.e. AWS, Azure, or 
Google): 


e Azure Solutions Architect Expert 
e Amazon Solutions Architect Associate 
e Professional Cloud Architect (GCP) 


A copy of the certificate(s) must be provided. 
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A.7 Programmer/Analyst (Cloud Solutions) — Level 3 


Resource Category: A.7 Programmer/Analyst (Cloud Solutions) — Level 3 


Name of proposed Resource: 


Contractor's Response 
Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 
(Contractors | resume 
to insert 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of five (5) years' experience within the last ten 
(10) years designing, developing, testing and deploying code and 
software for a cloud computing environment. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of seven (7) years' experience within the last ten 
(10) years designing, developing and implementing web-based 
applications using the following two languages: 

e Java 

e Node JS 
Note: The experience required is a combined total, however a 
minimum of 3 years must be demonstrated for EACH language. 
To qualify, a project must have a minimum duration of six (6) 
months. 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of two (2) years' experience within the last five (5) 
years' refactoring and deploying Enterprise-class solutions. 


Note: To qualify, a project must have a minimum duration of six 
(6) months. 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of twelve (12) months experience within the last 
five (5) years coding, testing and implementing solutions 
involving Cloud-based identity access management, Multi-factor 
authentication AND one of the following: 


e Biometric security models 
e Secure enclave processing 
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Resource Category: A.7 Programmer/Analyst (Cloud Solutions) — Level 3 


Name of proposed Resource: 


Contractor's Response 
Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 


(Contractors | resume 
to insert 
data) 


bullets above. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


Note: To qualify, a project must have a minimum duration of six 
(6) months. The experience can be demonstrated in various 
combinations across different projects, however the minimum 
experience must be demonstrated for EACH one of the three 


1.1 Data Conversion Specialist (Cloud Data Scientist)- Level 3 
Resource Category: 1.1 Data Conversion Specialist (Cloud Data Scientist) — Level 3 


Name of proposed Resource: 


Contractor's Response 
Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 


(Contractors | resume 
to insert 
data) 


a Data Warehouse, Data Mart or Data Lake; 
Performing exploratory data analysis, rapid prototyping 
and presenting creative ideas to exploit data to drive 
deeper insights and business value; 


The Contractor MUST demonstrate that the proposed resource 
has a minimum of five (5) years' experience within the last ten 
(10) years performing all of the following tasks and 
responsibilities: 
e Using methodologies from Machine Learning, Deep 

Learning and Artificial Intelligence; 

Applying Machine Learning using diverse types of data, 

diverse data sources and different types of learning 

models; 

Developing queries to isolate data with high value within 
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Resource Category: 1.1 Data Conversion Specialist (Cloud Data Scientist) — Level 3 


Name of proposed Resource: 


Contractor's Response 
Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 
(Contractors | resume 
to insert 


Providing proactive data analysis of large structured and 
unstructured datasets involving a wide range of systems 
across multiple disparate data sets; and 

Developing data analytic and visualization plans to 
support high-quality, fact-based business decisions. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the proposed resource 
has a minimum of five (5) years' experience within the last ten 
(10) years performing a minimum of five (5) of the following tasks 
and activities: 

e Working with scalable data platforms such as; Power BI, 
Hadoop, Spark, Redshift, NoSQL (dynamoDB / 
MongoDB); 

Building the tools and supporting data structures needed 
to analyze data and perform data cleaning activities; 
Determining problematic issues with data and proposing 
feasible resolutions; 

Organizing, mapping, analyzing numerous data sets to 


incorporate them into one centralized data repository; 
Performing exploration of data, including analysis, mining 
of correlations and result verification; 

Developing and deploying solutions that addressed data 
aggregation challenges, including data being distributed 
across numerous databases or sources; and 

Developing and implementing strategies for data 
enrichment. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the proposed resource 
has a minimum of three (3) years' experience within the last five 
(5) years performing a minimum of three (3) of the following tasks 
and activities; 
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Resource Category: 1.1 Data Conversion Specialist (Cloud Data Scientist) — Level 3 


Name of proposed Resource: 


Criteria 


Mandatory Requirement 


Identifying opportunities for automation, knowledge 
discovery, decision-making, insights, optimization, and 
new capabilities; 

Developing frameworks and best practices for analytic 
solutions at different maturity levels; 

Preparing documentation, reports, and presentations that 
explain advanced analytics concepts, technology, and 
inner workings of solutions to broader teams, including 
non-technical audiences; and 

Mentoring other data scientists in the design, 
implementation, testing, prototyping, and deploying of 
data analytic solutions. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate the proposed resource holds: 


A Masters' degree in a quantitative discipline such as applied 
mathematics, computer science, data science, statistics or 
econometrics, 


OR 


An equivalent Canadian academic credential assessment, if 
obtained outside Canada. 


The Contractor must include a copy of the degree(s). 
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1.1 Data Conversion Specialist (Cloud Data Migrations)- Level 3 


Resource Category: 1.1 Data Conversion Specialist (Cloud Data Migrations) — Level 3 


Name of proposed Resource: 


Contractor's Response 
Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 
(Contractors | resume 
to insert 


The Contractor MUST demonstrate that the proposed resource 
has a minimum of five (5) years' experience within the last ten 
(10) years performing all of the following tasks: 


Design, develop and administer significant (greater than 
500 GB) DB2 databases; 

Troubleshoot and optimize DB2 databases; and 
Automate solutions for repeatable problems or 
maintenance activities. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the proposed resource 
has a minimum of five (5) years' experience within the last ten 
(10) years performing all of the following tasks: 
e Conduct exploratory data analysis on databases to 
understand and identify data quality issues prior to a 
significant upgrade or migration of database; 


Determine problematic issues with data and data 
structures and present findings to stakeholders; and 
Identify, test and develop solutions to data quality 
problems or database performance issues. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the proposed resource 
has a minimum of five (5) years' experience within the last ten 
(10) years performing all of the following tasks: 


e Developing and planning data migration strategies for 
secure application migrations to the cloud; 
Designing and building solutions, and using appropriate 
tools to migrate existing applications and their databases 
from an in-premise database environment to a secure 
cloud environment; 
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Resource Category: 1.1 Data Conversion Specialist (Cloud Data Migrations) — Level 3 


Name of proposed Resource: 


Criteria 


Contractor's Response 


Demonstrate | Insert 

Mandatory Requirement d experience | page # of 
(Contractors | resume 
to insert 


Developing data validation approach, test plan, scenarios 
and scripts, as necessary, to demonstrate completeness, 
integrity and security of the migrated data to the cloud; 
and 

e Performing post-migration activities. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 


The Contractor MUST demonstrate that the proposed resource 
has a minimum of two (2) years' experience within the last ten 
(10) years performing a minimum of four (4) of the following 
tasks: 


Migrating mainframe databases to a UNIX or LINUX 
platform; 

Designing, developing, or administering distributed 
databases; 

Developing, testing and executing data cleansing 
solutions; 

Developing scripts using bash, Perl and/or Python; and 
Using ETL tools such as DataStage. 


Note: To qualify, a project must have a minimum duration of six 
(6) months 
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C.11-Information Technology Security Vulnerability Analysis Specialist (Cloud) — Level 3 


Resource Category: C.11 Information Technology Security Vulnerability Analysis Specialist (Cloud) — 
Level 3 


Name of proposed Resource: 


Contractor's Response 


Demonstrate 

Mandatory Requirement d experience 
(Contractors 
to insert 


The Contractor MUST demonstrate that the Proposed Resource 
has a minimum of five (5) years' experience within the last ten 
(10) years conducting IT Security vulnerability assessments. 


The Contractor MUST demonstrate that the proposed resource 
possesses a current professional certification from any of the 
following: 


CISSP from (ISC) 

CISM from ISACA 

CRISC from ISACA 

GIAC / Any Int/Adv Cyber Security certification 
GIAC / Any Int/Adv Cyber Defense certification 
GIAC / Any Penetration Testing Certification 
CEH (Certified Ethical Hacker) 

GICSP 

GWAPT 

GWEB 

CISA 


A copy of the Certification must be provided with the bid. 


The Contractor MUST demonstrate that the Proposed Resource 
has experience in the past two (2) years performing Vulnerability 
Assessments and Penetration Testing for secure* public Cloud- 
based environments, services or solutions for five (5) different 
clients (separate legal entities) including all of the following 
activities: 


e Conducting an assessment of the assets and data 
involved including the business value in addition to the 
technology/technical configuration involved; 

Conducting thorough vulnerability scans and penetration 
testing to identify vulnerabilities that may leave the 
organization or data open to threats or theft; 

Using automated vulnerability assessment tools; 
Producing an actionable and prioritized list of deficiencies 
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Resource Category: C.11 Information Technology Security Vulnerability Analysis Specialist (Cloud) — 
Level 3 


Name of proposed Resource: 


Contractor's Response 


Demonstrate | Insert 
Criteria Mandatory Requirement d experience | page # of 

(Contractors | resume 

to insert 

data) 


with explanations and technical recommendations; and 
e Preparing a summary report for management. 


Note: To qualify, a project must have a minimum duration of 20 
days. 


* Secure is defined as designed to meet one of the following 
security control profiles: 
o the Government of Canada Protected B Medium 
integrity Medium availability (PBMND. 
o FEURAME Moderate or High Level 
o 190 27001, 150 27017 and ISO 27018 
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2.0 Point Rated Resource Assessment Criteria: 


1.6 Network Analyst — Level 3 


Resource Category: 1.6 Network Analyst — Level 3 


Name of proposed Resource: 


The Contractor should 
demonstrate that the 
Proposed Resource has 
additional experience, in 
excess of the minimum M1.2 
mandatory requirement of 
five (5) years, designing and 
architecting Infrastructure 
solutions leveraging cloud 
technologies and services 
including all the following: 


e Next Generation 
Firewalls 
Virtual networks, 
subnets and User 
Defined Routing (UDR) 
Multi-Protocol Label 
owitching 
Security Groups 
Application gateways 
and load balancing 
Network failover 
Containers 
Elastic Computing 
Storage and backup 
Infrastructure as code 


Note: A qualifying project will 
have a minimum duration of 
six (6) months 


The Contractor should 
demonstrate that the 
Proposed Resource has 
additional experience in 
excess of the minimum M1.3 
mandatory requirement of 
eighteen (18) months within 
the past five (5) years (prior 


5+ years up to 6 
years = 5 points 


6+ years up to 7 
years = 10 points 


7+ years up to 8 
years = 15 points 


More than 8 years 
= 20 points 


Maximum 20 
points 


18+ months up to 
2 years - 5 points 


2+ years up to 3 
years = 8 points 


3+ years up to 4 
years = 12 points 


Bidder's Response 


Demonstrated Insert Page £ 
Experience of Resume 
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Resource Category: 1.6 Network Analyst — Level 3 


Name of proposed Resource: ee 


| | BiddersResponse — | 
Point-Rated Requirement Demonstrated Insert Page # 
Experience of Resume 


to solicitation issue date) More than 4 years 
configuring, deploying, id - 15 points 
supporting Virtual Networks, 

Next Generation Firewalls, 

routing and security groups 

within a Production Cloud 

environment designed to 

meet any of the following 

security control profiles: 


e the Government of 
cenace rorectec - 


Medi ium aval lab lity 
(PEMM) Profile 

SmO RAV Moderate 
or High Level 

ISO 27807, ISO 
26/01; and ISO 
21016 


Note: A qualifying project will 
have a minimum duration of 
six (6) months 
The Contractor should For each task: 
demonstrate that the 
Proposed Resource has Less than 1 year = 
Cloud experience within the 0 points 
last five (5) years performing 
the following tasks: 1 year up to 3 
years - 2 points 
e Exposed Virtual 
machines and cloud More than 3 years 
services in virtual - 3 points 
networks to the Internet 
using an external load 
balance service. 
Utilized Security Groups 
and Access Control List 
(ACLs) for incoming and 
outgoing packets 
Designed User Defined 
Routes for specific 
cases to force tunneling 
to the Internet via an 
on-premise network. 
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Resource Category: 1.6 Network Analyst — Level 3 


Name of proposed Resource: ee 


| | BiddersResponse — | 
Point-Rated Requirement Demonstrated Insert Page £ 
Experience of Resume 


e Designed BGP routes 
to enable dedicated 
direct cloud connections 
(e.g. ExpressRoute / 
Direct connection) 
between an on-premise 
data center and a cloud 
environment. 


Note: A qualifying project will 
have a minimum duration of 
six (6) months 


The Contractor should 
demonstrate that the 
Proposed Resource has 
experience within the last 5 
years (as of solicitation issue 
date) designing, deploying 
and supporting cloud 
network infrastructure and 
services hosted on Amazon 
Web Services. 


Note: A qualifying project will 
have a minimum duration of 
six (6) months 


The Contractor should 
demonstrate that the 
Proposed Resource has a 
current and valid Firewall 
Administrator certification 
from a Next Generation 
Firewall vendor (e.g. Cisco, 
Fortinet, Palo Alto, etc.). 


A copy of the certificate(s) 
should be provided with the 
bid. 


The Contractor should 
demonstrate that the 
Proposed Resource has: 


Less than 1 year = 
0 points 


1 year up to 2 
years = 1 point 


2+ years up to 3 
years = 3 points 


More than 3 years 
= 5 points 


No certificates = 0 
points 


1 or more 
Certificate(s) = 5 
points 


No 
Degree/Diploma = 
0 points 
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Resource Category: 1.6 Network Analyst — Level 3 


Name of proposed Resource: ee 


Bidder's Response 
Point-Rated Requirement Demonstrated Insert Page £ 
Experience of Resume 


A university degree or post- Degree/Diploma = 
secondary diploma in 5 points 
Computer Science or a 
related field in Information 
Technology, obtained 
through a recognized 
Canadian university or 
college; OR 

An equivalent Canadian 
academic credential 
assessment, if obtained 
outside Canada. 

A copy of the university 
degree, college diploma or 
academic credential 
assessment WILL be 
included with the 
Contractor's response to the 
TA. The copy WILL be a 
readable copy in English or 
French. 


1.7 Platform Analyst — Level 3 


Resource Category: |.7 Platform Analyst — Level 3 


Name of proposed Resource: 


Bidder's Response 
Point-Rated Requirement — ers Insert Page # 
Experience of Resume 


The Contractor should 

demonstrate that the Proposed Basso - 
Resource has: 0 points 

A university degree or post- Degree/Diploma - 
secondary diploma in Computer 5 points 

Science or a related field in 

Information Technology, 
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Resource Category: |.7 Platform Analyst — Level 3 


Name of proposed Resource: 


NENNEN Bidder's Response 
Point-Rated Requirement Demonstrated | Insert Page # 
Experience of Resume 


obtained through a recognized 
Canadian university or college; 
OR 
An equivalent Canadian 
academic credential 
assessment, if obtained outside 
Canada. 
A copy of the university degree, 
college diploma or academic 
credential assessment WILL be 
included with the Contractor's 
response to the TA. The copy 
WILL be a readable copy in 
English or French. 
The Contractor should Up to 5 points per 
demonstrate that the Proposed project for a 
Resource has experience maximum of 4 
implementing one or more of projects as follows: 
the following security patterns 
within an IT solution: 1 pattern = 2 
points 
e System and method for 2 patterns = 4 
generating and points 
authenticating passwords 3 patterns = 5 
using key inputs and points 
contextual inputs 
Method and system for 
authenticating a security 
device 
Method and system for 
establishing trusted 
communication using a 
security device 
Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should Less than 5 
demonstrate that the Proposed technologies = 0 
Resource has: 
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Resource Category: |.7 Platform Analyst — Level 3 


Name of proposed Resource: | | 


Amd. No. - N? de la modif. 


Buyer ID - Id de l'acheteur 


606el 


Point-Rated Requirement 


Implementation experience 
with at least 5 of the following 
technologies; 


FIDO2 

Okta 

Gluu 

RSA encryption 

Ping Identity 

WSO2 

AuthO 

Google Duo 
ForgeRock 

Azure Active Directory 
AWS Active Directory 


Note: A qualifying project will 
have a minimum duration of 
three (3) months 


The Contractor should 
demonstrate that the Proposed 
Resource has experience 
developing and implementing 
cloud-based applications using 
one or both of the following: 


e Java 
e Node JS 


Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should 
demonstrate that the Proposed 
Resource has experience 
designing and implementing 
Hybrid Cloud Enterprise 
solutions. 


Note: A qualifying project will 
have a minimum duration of six 
(6) months 


Part — 


5 to 6 A .] 
- 10 points 


7 to 8 technologies 
- 15 points 


9 or more 
technologies = 20 
points 


Less than 2 years 
= 0 points 


2 years up to 3 
years = 6 points 


3+ years up to 5 
years = 8 points 


More than 5 years 
- 10 points 


Less than 1 year = 
0 points 


1 year up to 3 
years = 10 points 


3+ years up to 5 
years = 15 points 


More than 5 years 
= 20 points 


Bidder's Response 


pomana Damon Insert Page # 
Experience of Resume 
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Resource Category: |.7 Platform Analyst — Level 3 


Name of proposed Resource: 


NENNEN Bidder's Response 
Point-Rated Requirement Demonstrated | Insert Page # 
Experience of Resume 


MAX. AVAILABLE POINTS 
MIN. POINTS REQUIRED 


1.9 System Administrator — Level 3 


The Contractor should Less than 1 year = 
demonstrate that the proposed 0 points 
resource has experience 
implementing and supporting 1 year up to 2 
solutions hosted on Amazon years = 1 point 
Web Services. 
2+ years up to 3 
years = 3 points 
More than 3 years 
- 5 points 


Resource Category: 1.9 System Administrator — Level 3 


Name of proposed Resource: 


Bidder's Response 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


The Contractor should NO 

demonstrate that the Proposed Degree/Diploma 
Resource has: = 0 points 

À university degree or post- Degree/Diploma 
secondary diploma in = 5 points 
Computer Science or a related 

field in Information Technology, 

obtained through a recognized 

Canadian university or college; 

OR 

An equivalent Canadian 

academic credential 

assessment, if obtained 

outside Canada. 

À copy of the university degree, 

college diploma or academic 

credential assessment WILL be 
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Resource Category: 1.9 System Administrator — Level 3 


Name of proposed Resource: 


Point-Rated Requirement 


included with the Contractor's 
response to the TA. The copy 
WILL be a readable copy in 
English or French. 


The Contractor should 
demonstrate that the Proposed 
Resource has experience 
within the last ten (10) years 
performing the following tasks 
in a Cloud environment: 


Deploying and managing 
Highly Available, resilient 
cloud resources with no 
single points of failure; 
Performing system 
hardening on newly 
provisioned environments; 
Developing and utilizing 
automation techniques to 
allocate additional 
resources as and when 
needed; and 

Designing and 
implementing a tiered 
backup and restore 
strategy for data of 
varying values to the 
organization. 


Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should 
demonstrate that the Proposed 
Resource has experience 
within the last ten (10) years 
managing system resources 
using VMWare products. 


For each task: 


Less than 1 year 
= 0 points 


1 year up to 2 
years = 1 point 


2+ years Up to 4 
years = 2 points 


4+ years Up to 6 
years = 3 points 


6+ years up to 7 
years = 4 points 


More than 7 years 


= 5 points 


2+ years up to 5 
years = 5 points 


5+ years up to 8 
years = / points 


Less than2 years 
= 0 points 


Buyer ID - Id de l'acheteur 
606el 


Bidder's Response 


Demonstrated |Insert Page # 
Experience of Resume 
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Resource Category: 1.9 System Administrator — Level 3 


Name of proposed Resource: 


Point-Rated Requirement 


The Contractor should 
demonstrate that the Proposed 
Resource has experience 
developing, testing, maintaining 
and executing automated 
provisioning and rebuild 
procedures for Cloud 
application resources. 


Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should 
demonstrate that the Proposed 
Resource has any of the 
following Associate-level 
certifications: 


Microsoft Certified Azure 
Administrator Associate 
OR Microsoft 365 Certified 
Security Administrator 
Associate OR MCSE Cloud 
Platforms and 
Infrastructure 

AWS Certified SysOps 
Administrator Associate 
Associate Cloud Engineer 
(GCP) 


A copy of the certificate(s) 
should be provided. 


MAX. AVAILABLE POINTS 
MIN. POINTS REQUIRED 


Less than 2 years 
= 0 points 


2+ years up to 5 
years = 5 points 


5+ years up to 8 
years = / points 


More than 8 years 
=10 points 


No Certification = 
0 points 


1 Certification = 5 


2 Certifications or 
more = 10 points 


|  Bidder’s Response | 


Demonstrated |Insert Page # 
BE NN Resume 


Part — Partie 2 of — de 2 / Page 67 of - de 103 


000068 


Contract No. - N° du contrat And. No. - N° de la modif. Buyer ID - Id de l'acheteur 
47419-198132/001/EL 606el 


1.10 Technical Architect (Cloud Security) — Level 3 


Resource Category: 1.10 Technical Architect (Cloud Security) — Level 3 


Name of proposed Resource: | O Z O Zć OZ OZ OZ OZ OZ Ç OÇűć o—çćç 


Points | Bidders Response | 
Point-Rated Requirement Max Demonstrated |Insert Page # 
Experience of Resume 


The Contractor should 
demonstrate that the Proposed En 
Resource has: = 0 points 
À university degree or post- Degree/Diploma 
secondary diploma in = 10 points 
Computer Science or a related 
field in Information Technology, 
obtained through a recognized 
Canadian university or college; 
OR 
An equivalent Canadian 
academic credential 
assessment, if obtained 
outside Canada. 
À copy of the university degree, 
college diploma or academic 
credential assessment WILL be 
included with the Contractor's 
response to the TA. The copy 
WILL be a readable copy in 
English or French. 
The Contractor should 5+ years up to 7 
demonstrate that the Proposed years = 8 points 
Resource has additional 
experience in excess of M4.2 7+ years up to 8 
minimum 5 years mandatory years = 14 points 
requirement, including 3 years 
in a Cloud environment, More than 8 
performing the following tasks: years = 20 points 
e Defining Technical and 
Functional security 
requirements; 
Creating Security 
Architecture; 
Participating in 
Infrastructure and 
Application Architecture 
Reviews; 
e Participating in 
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000069 


Contract No. - N° du contrat 


47419-198132/001/EL 


Resource Category: 1.10 Technical Architect (Cloud Security) 


Name of proposed Resource: 2 OZ— OZ Z OÇZ— Z OÇćű ç Oçć ç 


Amd. No. - N° de la modif. 


— Level 3 


Buyer ID - Id de l'acheteur 
606el 


Infrastructure and 
Application Design 
Reviews; and 
Performing IT 
Certification or 
Assessment activities 


Note: A qualifying project will 
have a minimum duration of 
three (3) months 


The Contractor should 
demonstrate that the Proposed 
Resource has experience 
preparing Threat & Risk 
Assessments on Cloud-based 
applications for government 
projects/initiatives involving any 
of the following: 


Biometric identification 
Multi-factor 
authentication, secure 
enclave processing 
Mobile device-based 
multi factor 
authentication 
Cloud-based Identity 
Access Management 
Artificial Intelligence or 
Machine Learning 
Robotic Process 
Automation 

Analytic Pipelines 


Note: A qualifying project will 
have a minimum duration of 
two (2) months. 


The Contractor should 
demonstrate that the Proposed 
Resource has experience 
completing Security 
assessments of infrastructure 
or applications within Microsoft 


1 project = 5 
points 


2 projects = 10 
points 


3 projects = 15 
points 


4 projects = 20 
points 


5+ projects = 25 
points 


2 points per 


assessment up to 


maximum of 10 
assessments 


| Bidders Response | 


Demonstrated |Insert Page # 
Experience of Resume 
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Resource Category: 1.10 Technical Architect (Cloud Security) — Level 3 


Name of proposed Resource: | | | O —Z— OZ OZ— OZ Z OÇZ— Z OÇćű ç Oçć ç 


| Bidders Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


Azure, AWS or GCP cloud 
environments 


Note: A qualifying assessment 
will have a minimum duration of 
two (2) months. 


The Contractor should Less than 1 year 
demonstrate that the Proposed = 0 points 
Resource has experience 

designing architecture, 1 year up to 3 
applications or infrastructure years = 5 points 
incorporating security controls 

according to OWASP 3+ years up to 5 
recommendations. years = 10 points 


5+ years up to 7 


Note: A qualifying project will 
S S years = 15 points 


have a minimum duration of six 


SS AIDS More than 7 


years - 20 points 


1.11 Technology Architect — Level 3 


Resource Category: 1.11 Technology Architect — Level 3 


Name of proposed Resource: | | — | | O Z O — O —ć o çć Y 


Bidder's | Bidder’s Response | 
Point-Rated Requirement Insert Page # 
d Experience | of Resume 


The Contractor should 

demonstrate that the Proposed v: - 
Resource has: 0 points 

A university degree or post- Degree/Diploma - 
secondary diploma in Computer 10 points 

Science or a related field in 

Information Technology, 

obtained through a recognized 
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Resource Category: 1.11 Technology Architect — Level 3 


Name of proposed Resource: |. | | | | | | |  — o ç 


| | Bidders Response | 
Point-Rated Requirement Demonstrate |Insert Page # 
d Experience | of Resume 


ae university or college; 


An equivalent Canadian 
academic credential 
assessment, if obtained outside 
Canada. 


A copy of the university degree, 
college diploma or academic 
credential assessment WILL be 
included with the bid. The copy 
WILL be a readable copy in 
English or French. 


The Contractor should 10 points per 
demonstrate that the Proposed project up to 
Resource has experience maximum of 3 
performing the following tasks projects (30 
supporting Legacy-to-Cloud points) 
application migration projects: 


e Collecting relevant data on 
customer's existing 
applications including: 
architecture, workloads, 
services, data volumes, 
users, support 
requirements, network and 
other infrastructure 
requirements; 

Conducting cloud 
assessments and analysis 
of workloads and services to 
determine which workloads 
are good candidates for 
migration; 

Mapping source 
environment 
resources/services to target 
resources/services; 
Defining and designing 
appropriate to-be 
application, platforms, and 
hosting architectures in 
public/private clouds; 
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Resource Category: 1.11 Technology Architect — Level 3 


Name of proposed Resource: |. | | | | | | |  — o ç 


| | Bidders Response | 
Point-Rated Requirement Demonstrate |Insert Page # 
d Experience | of Resume 


Designing cloud architecture 
that meets key non- 
functional requirements 
(security, compliance, 
performance, resiliency, and 
availability); 

Overseeing the migration of 
workloads and capabilities 
(e.g. Disaster recovery, 
archiving/backup) to cloud; 
and 

Leveraging cloud specific 
services (e.g. Web 
Application PaaS, Resource 
Manager, etc.) to 
implement desired cloud 
operating models and 
enable DevOps capabilities. 


Note: A qualifying project will 
have a minimum duration of 
nine (9) months and contain 
completion of at least three of 
the listed tasks. 


The Contractor should 5 to 6 tasks = 5 

demonstrate that the Proposed points 

Resource has experience with 

large or complex* data 7 to 8 tasks = 10 

migrations including five or more points 

of the following: 

Plus 10 points for 

Developing the strategy the number of 
Creating the plan years of 
Analyzing data quality experience as 
Resolving data issues follows: 
Validating accuracy, 
performance, accessibility, 
security and reliability 


Loading 3+ years up to 4 


Switch-over years = 5 points 
Optimization 


1 year up to 3 
years = 2 points 


4+ years up to 5 
* Large or complex describes a years = 8 points 
database that contains a 
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000073 


Contract No. - N° du contrat 
47419-198132/001/EL 


Resource Category: 1.11 Technology Architect — 


Name of proposed Resource: |. | | | | | | |  — o ç 


mn Point-Rated Requirement FORCE 


significant volume of data (more 


than 250 GB) or a broad data 
structure with many 


relationships defined to the point 


that queries and normal 
operations require specialized 
application and database 
optimization approaches. 


Note: À qualifying project will 


have a minimum duration of six 
(6) months 


The Contractor should 
demonstrate that the Proposed 
Resource has experience 
architecting and migrating on- 
premise Enterprise-class 
applications to an environment 
hosted on one of the Gartner 
2019 Magic Quadrant for laaS 
cloud platforms (AWS, Azure or 
Google) using a Hybrid cloud 
deployment model. 

Note: A qualifying project will 
have a minimum duration of six 


(6) months 


The Contractor should 
demonstrate that the Proposed 
Resource has experience with 
one of the following activities 
and tasks in a Cloud 
environment: 


e Designing data 
warehousing as a service 
solutions 
Designing data lakes that 


scale with ingested data but 
also discard data due to low 


value or if it contravenes 
policy to retain it 


Amd. No. - N° de la modif. Buyer ID - Id de l'acheteur 


606el 


Level 3 


| | Bidders Response | 


Demonstrate |Insert Page # 
d Experience | of Resume 


More than 5 years 
- 10 points 


1 project = 3 
points 

2 projects = 6 
points 

3 projects = 10 
points 

4 or more projects 
- 15 points 


0 projects = 0 
points 


1+ project = 5 
points 
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Resource Category: 1.11 Technology Architect — Level 3 


Name of proposed Resource: |.  — | | O 


| | Bidders Response | 
Point-Rated Requirement Demonstrate |Insert Page # 
d Experience | of Resume 


Note: A qualifying project will 
have a minimum duration of 
twelve (12) months 


B.2 Business Architect — Level 3 


Resource Category: B.2 Business Architect — 


Name of proposed Resource: 1. 


Level 3 


| Bidders Response | 


Point-Rated Requirement Pus Demonstrated |Insert Page # 
Experience of Resume 


The Contractor should 
demonstrate that the Proposed 
Resource has experience within 
the last ten (10) years 
supporting initiatives by: 


e Assessing 
transformation initiative 
impacts on job roles 
and organization 
structures; AND 
Making 
recommendations as to 
the best use of public 
funds 


Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should 
demonstrate that the Proposed 
Resource has experience within 
the last ten (10) leading* Agile 
or Digital Transformation 


Less than 5 years 
= 0 points 


5 years up to 6 
years = 8 points 


6+ years up to 7 
years = 12 points 


7+ years up to 8 
years = 16 points 


More than 8 
years - 20 points 


1 project = 10 
points 

2 projects = 15 
points 


3+ projects = 20 
points 


Part — Partie 2 of — de 2 / Page 74 of - de 103 


000075 


Contract No. - N° du contrat 


47419-198132/001/EL 


Amd. No. - N° de la modif. 


Resource Category: B.2 Business Architect — Level 3 


Name of proposed Resource: 


Point-Rated Requirement LE 


initiatives within a public 
sector organization. 


“Leading — Defined as the 
person in charge of the day to 
day activities of the project. 


Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should 
demonstrate that the proposed 
resource has: 


One (1) of the following 
certifications: 


Agile (Scrum.org, Agile 
Alliance, PMI) 

Change Management 
(PROSCII, Six Sigma, 
CCMP, ACMP) 


A copy of the Certification will 
be provided 


The Contractor should 
demonstrate that the proposed 
resource has: 


A post-graduate degree, post- 
graduate diploma, post- 
graduate certificate or industry 
certification related to Business 
Architecture (not used for any 
other criteria); OR 


An equivalent Canadian 
academic credential 
assessment, if obtained 
outside Canada. 


A copy of the post-graduate 
degree, diploma, certificate or 
academic credential 
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0 certification = 0 
points 


1 or more 
certifications = 10 
points 


0 document = 0 
points 


1 or more 
degree, diploma 
or certificate = 10 
points 


Buyer ID - Id de l'acheteur 


Bidder's Response 


Demonstrated |Insert Page # 
Experience of Resume 


000076 
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Resource Category: B.2 Business Architect — Level 3 


Name of proposed Resource: | | O—Zć OZ OZ O Z— OZ Z OÇűć—ć ç O—Çć 


| Bidders Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


assessment WILL be included 
with the Contractor's response 
to the TA. The copy WILL be a 
readable copy in English or 
French. 


A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Resource Category: A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Name of proposed Resource: 


|  Bidders Response | S |  Bidders Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


The Contractor should 

demonstrate that the Proposed Blass 
Resource has: = 0 points 
À university degree or post- Degree/Diploma 
secondary diploma in = 10 points 
Computer Science or a related 

field in Information Technology, 

obtained through a recognized 

Canadian university or college; 

OR 

An equivalent Canadian 

academic credential 

assessment, if obtained 

outside Canada. 

A copy of the university degree, 

college diploma or academic 

credential assessment WILL be 

included with the Contractor's 

response to the TA. The copy 

WILL be a readable copy in 

English or French. 
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Contract No. - N° du contrat And. No. - N° de la modif. Buyer ID - Id de l'acheteur 
47419-198132/001/EL 606el 


Resource Category: A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Name of proposed Resource: 


Bidder's Response 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


The Contractor should 5+ years up to 6 
demonstrate that the Proposed years = 5 points 
Resource has experience in 
excess of the minimum five (5) 6+ years up to / 
years within the last ten (10) years = 10 points 
years mandatory requirement 
in M7.3 performing the 7+ years up to 8 
following tasks within a public years = 15 points 
cloud environment: Moreananevears 

Creating the conceptual, = 20 points 

logical and physical 

designs for application 

architectures and their 

interoperability; 

Researching, analyzing, 

recommending and 

selecting technical 

approaches to address 

challenging development 

and integration problems 

with application 

architectures; and 

Developing implementation 

plans for the deployment of 

application architectures 
Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should For each activity: 
demonstrate that the Proposed 
Resource has experience Less than 1 year 
within the last twelve (12) years = 0 points 
as an Application/Software 
Architect performing the 1 year up to 3 
following activities: years = 2 points 
e Developing deployment 2 a E o > 
strategies for architectures years = 4 points 
in the cloud that included More than 5 years 
secure remote access such = 5 points 
as VPN gateways (client to 
gateway, gateway to 
gateway); 
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Resource Category: A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Name of proposed Resource: | Z< O—ć— OZ OZ OZ OZ— Z OÇű— ç O—Çć 


| . BiddersResponse | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


Developing deployment 
strategies for cloud 
architectures that included 
private (on-premise) 
networks for the storage 
and processing of more 
sensitive data; 

Developing deployment 
strategies for architectures 
of re-usable environments 
designed to test new data 
or application operations 
without affecting production 
usage. 


Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should For each activity: 
demonstrate that the Proposed 

Resource has experience Less than 1 year 
within the last twelve (12) years = 0 points 


as an Application / Software 
Architect performing the 1 year up to 3 
following activities: years = 2 points 


3+ years up to 5 


e Incorporating serverless | 
years = 4 points 


code in application 
architectures; More than 5 
Designing scaling sets of 
virtual machines to keep 
costs low while still 
providing acceptable 
response times during 
peak usage; 

Designing cloud-based 
authentication solutions 
allowing for single sign-on 
(SSO) among 
applications; and 
Designing cloud-based 
authentication solutions 
that implement multi- 
factor authentication. 


years = 5 points 
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Resource Category: A.1 Application/Software Architect (Cloud Solutions) — Level 3 


Name of proposed Resource: | Z< O—ć— OZ OZ OZ OZ— Z OÇű— ç O—Çć 
| _Bidder’s Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


Note: A qualifying project will 
have a minimum duration of six 
(6) months 


The Contractor should 0 projects = 0 
demonstrate that the Proposed points 
Resource has experience 
within the last twelve (12) years 1+ project = 5 
as an Application/Software points 
Architect performing any of the 
following tasks: 
e Developing deployment 
strategies for business 
intelligence tools within 
cloud architecture that 
address both structured 
and unstructured data; 
Designing data 
warehouse-as-a-service 
solutions; 
Designing data lakes that 
scale with ingested data 
but also discard data due 
to low value or if it 
contravenes policy to 
retain it 
Note: A qualifying project will 
have a minimum duration of 
twelve (12) months 
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A.7 Programmer/Analyst (Cloud Solutions) — Level 3 


Resource Category: A.7 Programmer/Analyst (Cloud Solutions) — Level 3 


Name of proposed Resource: | | — O čć O Zć— OZ/ OZ OZ Z OÇZ/ ç OÇűć o—çćçć 


| Bidders Response | 
Point-Rated Requirement 
Experience of Resume 
5+ years to 6 
years = 12 
points 


The Contractor should 
demonstrate that the 
proposed resource has 
experience, in excess of the 
minimum 5 years mandatory 
requirement in M8.1, 
designing, developing, testing 
and deploying code and 
software for a cloud 
computing environment. 


6+ years to 7 
years = 16 
points 


More than 7+ 
years = 20 
points 

Note: A qualifying project will 
have a minimum duration of 
six (6) months 


The Contractor should 0 Certifications = 
demonstrate that the 0 points 
proposed resource has: 
1 or more 

One (1) of the following Certifications = 10 
certifications applicable to points 
Infrastructure as a Service 
(laaS) platforms from one or 
more Leaders in the Gartner 
2019 Magic Quadrant for laaS 
Cloud (i.e. AWS, Azure, or 
Google): 

AWS Certified Developer 

Azure Developer 

Associate 

Google Professional 

Cloud Developer 
Note: A copy of the 


certification should be 
provided. 


The Contractor should 
demonstrate that the 
proposed resource has 
experience designing, 
developing, testing and 


0 projects = 0 
points 

1 project = 2 
points 
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Resource Category: A.7 Programmer/Analyst (Cloud Solutions) — Level 3 


Name of proposed Resource: 


Bidder's Response 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


deploying code and software 2 projects = 4 
for one or more of the points 
following types of solution 3+ projects = 6 
projects: points 


Mobile computing 
Artificial Intelligence or 
Machine Learning 
Robotic process 
automation 

Biometrics 

Analytic Pipelines 


Note: A qualifying project will 
have a minimum duration of 
twelve (12) months 


Projects should be fully 
described including the 
platform, technology and 
specific 
features/functionalities (high- 
level) deployed. 


The Contractor should Less than 3 years 
demonstrate that the = 0 points 
proposed resource has 

experience designing, 3 years up to 4 
developing, testing and years = 10-points 
deploying code and software 

for web-based solutions 4+ years Up to 5 
including the following: years = 12 points 


e back-end and web-tier More than 5 
components for data years = 15 points 
collected externally (to 
the organization) and/or 
internally; 
application code to 
process the data in some 
manner 
security controls 
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Resource Category: A.7 Programmer/Analyst (Cloud Solutions) — Level 3 


Name of proposed Resource: | | | O » O 


| Bidders Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


Note: A qualifying project will 
have a minimum duration of 
six (6) months. 


Projects should be described 
including the architecture, 
data collected (including 
source/method) and 
processing functionality (ies) 
deployed. 


The Contractor should Points will be 
demonstrate that the allocated per 
proposed resource has language as 
experience designing, follows: 
developing and implementing 

web-based applications using Less than 2 years 
the following languages: = 0 points 


Python, 2 years up to 3 
Vue JS, years - 2 points 
Angular 

3+ years up to 4 


Note: A qualifying project will years = 3 points 

have a minimum duration of 

six (6) months 4+ years up to 5 
years - 4 points 


More than 5 
years = 5 points 


The Contractor should Less than 1 year 
demonstrate that the = 0 points 
proposed resource has 

experience in reverse More than 1 year 
engineering legacy software = 5 points 
applications created in one or 

more of the following: 


e COBOL (Mainframe) 
C/C++ 
J2EE 


Note: A qualifying project will 


have a minimum duration of 
six (6) months. 
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Resource Category: A.7 Programmer/Analyst (Cloud Solutions) — Level 3 


Name of proposed Resource: | | | O » O 


| Bidders Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


The Contractor should Less than 1 year 
demonstrate that the = 0 points 
proposed resource has 
experience developing and 1 year up to 3 
deploying applications using years - 2 points 
AWS Developer tools. 
More than 3 
years - 4 points 


The Contractor should NO 
demonstrate that the Degree/Diploma 
Proposed Resource has: = 0 points 


A university degree or post- Degree/Diploma 
secondary diploma in - 5 points 


Computer Science or a 
related field in Information 
Technology, obtained through 
a recognized Canadian 
university or college; OR 


An equivalent Canadian 
academic credential 
assessment, if obtained 
outside Canada. 


A copy of the university 
degree, college diploma or 
academic credential 
assessment WILL be included 
with the Contractor's 
response to the TA. The copy 
WILL be a readable copy in 
English or French. 

MAX. AVAILABLE POINTS 
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1.1 Data Conversion Specialist (Cloud Data Scientist)- Level 3 


Resource Category: |.1 Data Conversion Specialist (Cloud Data Scientist)— Level 3 


Name of proposed Resource: | | | | | | 


| _Bidder’s Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


The Contractor should 5+ years up to 6 
demonstrate that the years = 5 points 
proposed resource has 
experience in excess of the 6+ years up to 7 
mandatory minimum 5 years years = 10 points 
requirement in M9.1 
performing all of the following 7+ years up to 8 
activities: years = 15 points 
e Using methodologies from More than 8 years 

Machine Learning, Deep = 20 points 

Learning and Artificial 

Intelligence; 

Applying Machine 

Learning using diverse 

types of data, diverse 

data sources and different 

types of learning models. 

Developing queries to 

isolate data with high 

value within a Data 

Warehouse, Data Mart or 

Data Lake; 

Performing exploratory 

data analysis, rapid 

prototyping and 

presenting creative ideas 

to exploit data to drive 

deeper insights and 

business value; 

Providing proactive data 

analysis of large 

structured and 

unstructured datasets 

involving a wide range of 

systems across multiple 

disparate data sets; and 

Developing data analytic / 

visualization plans to 

support high-quality, fact- 

based business decisions 
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Resource Category: |.1 Data Conversion Specialist (Cloud Data Scientist)— Level 3 


Name of proposed Resource: ee 


|  Bidders Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


Note: A qualifying project will 
have a minimum duration of 
six (6) months 


The Contractor should 5+ years up to 6 
demonstrate that the years = 5 points 
proposed resource has 

experience in excess of the 6+ years up to 7 
mandatory minimum 5 years years = 10 points 
requirement in M9.2 

performing five or more of the 7+ years up to 8 
following activities: years = 15 points 


e Working with scalable More than 8 years 
data platforms such as; = 20 points 
Power Bl, Hadoop, Spark, 
Redshift, NoSQL 
(dynamoDB / MongoDB); 
Building the tools and 
supporting data structures 
needed to analyze data 
and perform data 
cleansing activities; 
Determining problematic 
issues with data and 
proposing feasible 
resolutions; 

Organizing, mapping, 
analyzing numerous data 
sets to incorporate them 
into one centralized data 
repository; 

Performing exploration of 
data, including analysis, 
mining of correlations and 
result verification: 
Developing and deploying 
solutions that addressed 
data aggregation 
challenges, including data 
being distributed across 
numerous databases or 
sources; and 

Developing and 
implementing strategies 
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Resource Category: |.1 Data Conversion Specialist (Cloud Data Scientist)— Level 3 


Name of proposed Resource: | | 


|  Bidders Response | 
Point-Rated Requirement 


for data enrichment 


Note: A qualifying project will 
have a minimum duration of 
six (6) months. 


The Contractor should 
demonstrate that the 
proposed resource has 
experience within the last ten 
(10) years developing and 
testing custom algorithms and 
mathematical models as 
required to solve unique 
business challenges: 


Note: A qualifying project will 
have a minimum duration of 
six (6) months. 


The Contractor should 
demonstrate that the 
proposed resource has 
experience within the last ten 
(10) years performing the 
following tasks: 


e Developing strategies to 
develop and filter data 
sets related to 
macroeconomic models 
within Data Lakes; and 
Developing visualizations 
relating to 
macroeconomic models. 


Note: A qualifying project will 
have a minimum duration of 
six (6) months. 


The Contractor should 
demonstrate that the 
proposed resource has 
experience within the last ten 


Demonstrated |Insert Page # 
Experience of Resume 


Less than 2 years 
= 0 points 


2 years up to 5 
years = 5 points 


5+ years up to 6 
years = 10 points 


6+ years up to 7 
years = 15 points 


More than 7 years 
= 20 points 


Less than 2 years 
= 0 points 


2 years up to 5 
years = 5 points 


5+ years up to 6 
years = 10 points 


6+ years up to 7 
years = 15 points 


More than 7 years 
= 20 points 


Less than 2 years 
= 0 points 


2+ years up to 5 
years = 5 points 
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Resource Category: |.1 Data Conversion Specialist (Cloud Data Scientist)— Level 3 


Name of proposed Resource: 


(10) years performing the 
following tasks: 


e Developing strategies to 
develop and filter large 
(greater than 250GB) data 
sets for reports and 
analysis; 

Designing data 
transformation routines to 
be performed on data 
sources being ingested; 
and 

Performing data extract 
and load operations as 
required 


Note: A qualifying project will 


have a minimum duration of 
six (6) months. 


The Contractor should 
demonstrate that the 
proposed resource has 
completed or obtained: 
A post-graduate diploma, 
post-graduate certificate or 
industry certification related to 
any of the following: 
Data Science; 
Machine Learning 
Artificial Intelligence 
Natural Language 
Programming 
The Contractor should include 
a copy of the diploma(s) or 
certificate(s). 


MAX. AVAILABLE POINTS 


5+ years up to 6 
years - 10 points 


6+ years up to 7 
years = 15 points 


More than 7 years 
= 20 points 


No 


diploma/certificate 
= 0 points 


1+ post-graduate 
diploma/certificate 
= 10 points 


Bidder's Response 


Demonstrated |Insert Page # 
Experience of Resume 
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1.1 Data Conversion Specialist (Cloud Data Migrations)- Level 3 


Resource Category: |.1 Data Conversion Specialist (Cloud Data Migrations)- Level 3 


Name of proposed Resource: | | | | | Z O  |— O —çć ç 


Bidder's Response 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


The Contractor should No 
demonstrate that the Degree/Diploma 
Proposed Resource has: = 0 points 
À university degree or post- Degree/Diploma 
secondary diploma in = 5 points 
Computer Science or a related 

field in Information 

Technology, obtained through 

a recognized Canadian 

university or college; OR 

An equivalent Canadian 

academic credential 

assessment, if obtained 

outside Canada. 

À copy of the university 

degree, college diploma or 

academic credential 

assessment WILL be included 

with the Contractor's response 

to the TA. The copy WILL be a 

readable copy in English or 

French. 


The Contractor should 
demonstrate that the 
Proposed Resource has 
experience architecting and 
migrating Production data 
into a cloud environment 
designed to meet any of the 


Less than 1 year 
= 0 points 


1 year up to 3 
years = 8 points 


3+ years Up to 4 
years = 14 
points 


following security control 
profiles: 


More than 4 
years = 20 
points 


e the Government of 
Canada Protected B 
Medium intedrnity 


Medium availability 
(PRMM) Profile. 


rUmRANMP Moderate 
or High Level 
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Name of proposed Resource: 


Point-Rated Requirement ko 


e 5027001, 5O 


2/017 and 150 27018 


Note: A qualifying project will 
have a minimum duration of 
six (6) months 


The Contractor should 
demonstrate that the 
Proposed Resource has: 


One or more of the following 
certifications: 


Azure Solutions 
Architect Expert 
Amazon Solutions 
Architect Associate 
Professional Cloud 
Architect (GCP) 


A copy of the certificate(s) 
should be provided. 


The Contractor should 
demonstrate that the 
Proposed Resource has 
additional experience, in 


excess of the minimum of five 


(5) years of demonstrated 
experience as per Mandatory 
Criteria M10.3, performing all 
of the following tasks: 


Developing and planning 
data migration strategies 
for secure application 
migrations to the cloud; 
Designing and building 
solutions and/or use 
appropriate tools to 
migrate existing 
applications and their 
databases from an in- 
premise database 
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0 certification = 
0 points 


1 or more 
certifications = 
10 points 


5+ years up to 6 
years = 12 
points 


6+ years up to 7 
years = 16 
points 


More than 7 
years - 20 
points 


Buyer ID - Id de l'acheteur 
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Resource Category: |.1 Data Conversion Specialist (Cloud Data Migrations)— Level 3 


Name of proposed Resource: 


Bidder's Response 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


environment to a secure 
cloud environment; 
Developing data validation 
approach, test plan, 
scenarios and scripts as 
necessary to demonstrate 
completeness, integrity 
and security of the 
migrated data to the 
cloud; and 

Performing post-migration 
activities. 


Note: A qualifying project will 
have a minimum duration of 
six (6) months 


The Contractor should Less than 1 year 
demonstrate that the proposed = 0 points 
resource has experience using 

AWS online and offline Data 1 year up to 3 
Migration tools. years - 2 points 


3+ years up to 4 
years - 4 points 


4+ years up to 5 
years = 6 points 


More than 5 
years = 8 points 
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C.11 Information Technology Security Vulnerability Analysis Specialist (Cloud) — Level 3 


Resource Category: C.11 Information Technology Security Vulnerability Analysis Specialist (Cloud) — 
Level 3 


Name of proposed Resource: Z O Z O 


Point-Rated Requirement 


The Contractor should 


demonstrate that the Proposed 


Resource has system 
administrative, design, 
development or support 


experience in the following 


areas: 


Public Cloud Infrastructure 


Secure Application 


Development 


Virtual Networking 


Big Data 


Cloud Security 


Note: A qualifying project will 
have a minimum duration of six 
(6) months and can be used to 
demonstrate more than one 


area. 


The Contractor should 


demonstrate that the Proposed 
Resource has experience 
analyzing security event logs 


from operating systems, 


intrusion detection systems, 
network, and remote access 


solutions 


Note: A qualifying project will 
have a minimum duration of 
three (3) months 


The Contractor should 


demonstrate that the Proposed 
Resource has experience 
testing web and/or mobile 
application security for the 
OWASP Top 10 Most Critical 
Application Security Risks and 
providing assistance and 


Part — 


For each area: 


Less than 1 year 
= 0 points 


More than 1 
year = 2 points 


Less than 1 year 
= 0 points 


1 year up to 3 
years = 2 points 


3+ years up to 5 
years = 5 points 


More than 5 
years = 10 


Less than 1 year 
= 0 points 


1 year up to 3 
years = 10 


Bidder's Response 


Demonstrated |Insert Page # 
Experience of Resume 
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Resource Category: C.11 Information Technology Security Vulnerability Analysis Specialist (Cloud) — 
Level 3 


Name of proposed Resource: | |. —čć Oč<— O Zć OZć OZ— č OÇZć ç O—<ć —çć 


Point-Rated Requirement 


Bidder’s Response 
Demonstrated |Insert Page # 
Experience of Resume 


3+ years up to 5 
years = 15 
points 

More than 5 
years = 20 
points 


The Contractor should 3 points per 
demonstrate that the Proposed project 
Resource has experience 
performing Vulnerability 
Assessments and Penetration 
Testing for public Cloud-based 
environments, services or 
solutions including the following 
activities: 

e Conducting thorough 
vulnerability scans and 
penetration testing to 
identify vulnerabilities 
that may leave the 
organization or data 
open to threats or theft; 
and 
Producing an 
actionable and 
prioritized list of 
deficiencies with 
explanations and 
technical 
recommendations 

Note: A qualifying project will 
have a minimum duration of 20 
days. 


The Contractor should No 
Degree/Diploma 
= 0 points 
Degree/Diploma 
= 10 points 


demonstrate that the Proposed 
Part — Partie 2 of — de 2 / Page 92 of - de 103 


guidance to developers to 
ensure a high level of 
application security. 


Note: A qualifying project will 


have a minimum duration of 
three (3) months 


Resource has: 


A university degree or post- 
secondary diploma in 
Computer Science or a related 
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Resource Category: C.11 Information Technology Security Vulnerability Analysis Specialist (Cloud) — 
Level 3 


Name of proposed Resource: 


| . Bidders Response | 
Point-Rated Requirement Demonstrated |Insert Page # 
Experience of Resume 


MAX. AVAILABLE POINTS 
MIN. POINTS REQUIRED 


field in Information Technology, 
obtained through a recognized 
Canadian university or college; 
OR 

An equivalent Canadian 
academic credential 
assessment, if obtained 
outside Canada. 

A copy of the university degree, 
college diploma or academic 
credential assessment WILL be 
included with the Contractor's 
response to the TA. The copy 
WILL be a readable copy in 
English or French. 
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APPENDIX D TO ANNEX A 
CERTIFICATIONS AT THE TA STAGE 


The following Certifications are to be used, as applicable. If they apply, they must be signed and 
attached to the Contractor's quotation when it is submitted to Canada. 


1. CERTIFICATION OF EDUCATION AND EXPERIENCE 


The Contractor certifies that all the information provided in the résumés and supporting material 
proposed for completing the subject work, particularly the information pertaining to education, 
achievements, experience and work history, has been verified by the Contractor to be true and accurate. 


Furthermore, the Contractor warrants that every individual proposed by the Contractor for the requirement 


is capable of performing the Work described in the Task Authorization. 
Print name of authorized individual & sign above Date 


2. CERTIFICATION OF AVAILABILITY OF PERSONNEL 


The Contractor certifies that, should it be authorized to provide services under this Task Authorization, 
the persons proposed in the quotation will be available to commence performance of the work within a 
reasonable time from the date of issuance of the valid Task Authorization, or within the time specified in 
the TA Form, and will remain available to perform the work in relation to the fulfillment of the requirement. 


Print name of authorized individual & sign above Date 


3. CERTIFICATION OF STATUS OF PERSONNEL 


If the Contractor has proposed any individual who is not an employee of the Contractor, the Contractor 
certifies that it has permission from that individual to propose his/her services in relation to the Work to be 
performed under this TA and to submit his/her résumé to Canada. At any time during the Contract Period 


the Contractor must, upon request from the Contracting Authority, provide the written confirmation, signed 


by the individual, of the permission that was given to the Contractor of his/her availability. Failure to 
comply with the request may result in a default under the Contract in accordance with the General 
Conditions. 


Print name of authorized individual & sign above Date 
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proposed — be able to communicate orally and in writing in French and English without any assistance 
and with minimal errors. 


oral and in writing in French without any assistance and with minimal errors. 


Print name of authorized individual & sign above Date 
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APPENDIX E TO ANNEX A 
GLOSSARY OF DEFINITIONS 


Analytic Pipeline 


Border Gateway Protocol 


BGP 


Canadian academic 
credentials assessment 


Configuration! 


Configuration’ 


Elastic Computing 


An analytic pipeline is a tool for collecting data from applications and 
various other sources, could include a transformational or cleansing 
step, could include some further processing or matching and then 
subjecting the data to analysis in order to produce a result within a 
certain timeframe. This is done separately from the production 
applications in order to avoid degradation in performance. 


Amazon Web Services 


Amazon Web Services is a subsidiary of Amazon that provides on- 
demand cloud computing platforms and APIs to individuals, 
companies, and governments, on a metered pay-as-you-go basis. 


Border Gateway Protocol is a standardized exterior gateway protocol 
designed to exchange routing and reachability information among 
autonomous systems on the Internet. The protocol is classified as a 
path vector protocol. 


Source: Wikipedia 


An Educational Credential Assessment is a statement of the general 
comparability of international educational credentials to a completed 
Canadian educational credential. 


The Canadian information Centre for International Credentials (CICIC) 
assists persons who wish to obtain an assessment of their educational, 
professional, and occupational credentials by referring them to the 
appropriate organizations. 


Configuration is the arrangement, relationships and customizations of 
hardware and/or software components that make up a computer 
system to enable the system to perform its intended use based on 
given requirements. 


Configuration is the activity of arranging and/or customizing the 
hardware and/or software components that make up a computer 
system to enable the system to perform its intended use based on 
given requirements. 


Concept in cloud computing in which computing resources can be 
scaled up and down easily by the cloud service provider. Elastic 
computing is the ability of a cloud service provider to provision flexible 
computing power when and wherever required. The elasticity of these 
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Enterprise-Class 


Enterprise Cloud Security 
Solution 


Enterprise Solution 


High Availability 


Highly Available 


resources can be in terms of processing power, storage, bandwidth, 
etc. 


Source: Techopedia 


Enterprise-class refers to applications or infrastructure services that 
are designed to be robust and scalable across a large organization. 
Gartner defines Enterprise-class as the ability of a given tool or product 
to handle complex processes or services. 


Further characteristics include: Open and compatible with existing 
databases and tools; Powerful enough to scale up along with the 
needs of the business using it; Secure from outside threats and data 
leaks. 


An Enterprise Cloud Security Solution is a comprehensive and unified 
suite of third-party configurable tools and practices that secure cloud- 
based network infrastructure, applications, connectivity, 
communications and data through native integration, heterogeneous 
protection, automation and management (policies, controls and 
visibility). They are specifically designed for cloud deployment and 
provide maximum security with minimal overhead. They support 
various operating environments including High Availability and auto- 
scaling. They provide automated threat monitoring, recognition and 
response. 


Enterprise solutions are designed to integrate multiple facets of a 
company's business through the interchange of information from 
various business process areas and related databases. These 
solutions enable companies to retrieve and disseminate mission-critical 
data throughout the organization, providing managers with real-time 
operating information. 


Source: Garner 


Google Cloud Platform 


Google Cloud Platform is a suite of public cloud computing services 
offered by Google. The platform includes a range of hosted services for 
compute, storage and application development that run on Googie 
hardware. 


High availability (HA) is the ability of a system or system component to 
be continuously operational for a desirably long length of time. 
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(HA) 


Availability experts emphasize that, for any system to be highly 
available, the parts of a system should be well-designed and 
thoroughly tested before they are used. Since a computer system or a 
network consists of many parts in which all parts usually need to be 
present in order for the whole to be operational, much planning for 


High Availability centers around backup and failover processing and 
data storage and access. 


Source: Tech! ardet 


At CBSA, the operational measure for High Availability is 99% 24/7 365 
days a year. 


Hybrid Cloud Hybrid cloud is a cloud computing environment that combines on- 
premises and public cloud infrastructures. 


There are multiple approaches to architecting a hybrid cloud. They 
include: 


Hybrid cloud management software (centralized management of 
both on-premises and public cloud infrastructure and applications); 
Vendor-native hybrid cloud — extending either the on-premises 
footprint to the public cloud or vice versa, and to connect public 
cloud resources with a data center. 

Platform as a service (PaaS) — an application development 
platform for developers to write custom applications without 
provisioning the underlying infrastructure they need to run. 


Source: Neiworkworid.com 


Implement In computer science, an implementation is a realization of a technical 
specification or algorithm as a program, software component, or other 
Implementation computer system through computer programming and deployment. 


In this context, to implement is the employing of techniques such as 
installing/injecting, configuring and/or developing the requirement and 
also deploying it successfully (operating without defects) into 
Production use. 


Source: Wikipedia 


"Lift-and-Shift" or Cloud migration approach which involves taking the entire application 
Rehost/Rehosting from its old infrastructure and moving it to the Cloud, involving no 
change, or with only very minor changes, or adjustment to the code. 
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Next-Generation Firewall 


NextGen Firewall 


OWASP Top 10 


Public Sector Organization 


Refactor/Refactoring 


Replatform/Re-platforming 


Rehosting is also known as lift-and-shift: you lift the code out of an 
environment and shift it to another. 


Source: DZone. com 


Next-generation firewalls are a class of firewall that are implemented in 
either software or hardware and are capable of detecting and blocking 
complicated attacks by enforcing security measures at the protocol, 
port and application level. 


The difference between a standard firewall and next-generation 
firewalls is that the latter performs a more in-depth inspection and in 
smarter ways. Next-generation firewalls also provide additional 
features like active directory integration support, SSH and SSL 
inspection, and malware filtering based on reputation. 


Source: Techopedia 


The OWASP Top 10 is a powerful awareness document for web 
application security. It represents a broad consensus about the most 
critical security risks to web applications. Project members include a 
variety of security experts from around the world who have shared their 
expertise to produce this list. 


Source: OWASP 


For the purpose of this procurement, a public sector organization is 
defined as any Department, Agency or Crown Corporation of the 
Canadian or U.S. Federal Governments, Canadian Provincial or U.S. 
State Governments, Municipal governments (representing Pop. 1+ 
Million). 


Cloud migration approach which involves a complete re-architecting of 
the app to better suit the new cloud environment. This often involves 
modifying the app itself and a large chunk of its code to better take 
advantage of cloud-based features and the extra flexibility that comes 
with them. Refactoring is a complex and resource-intensive process 
which requires a lot of time to complete. 


Source: DZone com 


Cloud migration approach which is similar to re-hosting in that the code 
is not altered excessively. However, re-platiorming involves some 
modification for the purpose of taking advantage of the new cloud 
infrastructure. Some modifications could include: modifying the way the 
app interacts with the database to benefit from automation and a more 
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capable database infrastructure; adding new features to enable better 
scaling and allow the app to benefit from the reserved resources of 
your cloud environment; or integrating the app with native features of 
the Cloud while keeping code modifications at a minimum. Source: 
Dcone com 


Reverse engineering Reverse engineering is "the process of analyzing a subject system to 
identify the system's components and their interrelationships, and to 
create representations of the system in another form or at a higher 
level of abstraction", where the "subject system" is the end product of 


software development. Reverse engineering is a process of 
examination only. 


There are two components in reverse engineering: re-documentation 
and design recovery. Re-documentation is the creation of new 
representation of the computer code so that it is easier to understand. 
Meanwhile, design recovery is the use of deduction or reasoning from 
general knowledge or personal experience of the product in order to 
fully understand the product functionality. 


Source: YVikipedia 
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ANNEX B 
BASIS OF PAYMENT 


INITIAL CONTRACT PERIOD: 


(August 4, 2020 to August 3, 2023) 


1.6 Network Analyst Level 3 
I.7 Platform Analyst Level 3 


1.9 System Administrator Level 3 
1.10 Technical Architect Level 3 
I.11 Technology Architect Level 3 


B.2 Business Architect Level 3 


A.1 Application/Software Architect 
A.7 Programmer/Analyst 


I.1 Data Conversion Specialist (Cloud Level 3 
Data Scientist) 


I.1 Data Conversion Specialist (Cloud Level 3 
Data Migrations) 


C.11 IT Security Vulnerability Analysis Level 3 | 
Specialist (Cloud) 


OPTION PERIODS: 
(August 4, 2023 to August 3, 2024) 


1.6 Network Analyst Level 3 


I.7 Platform Analyst Level 3 


1.9 System Administrator 
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1.10 Technical Architect 


Il.1 Data Conversion Specialist (Cloud Level 3 
Data Scientist) 
Il.1 Data Conversion Specialist (Cloud Level 3 
Data Migrations) 
C.11 IT Security Vulnerability Analysis Level 3 
Specialist (Cloud) 


Option Period 2 
(August 4, 2024 to August 3, 2025) 


|.7 Platform Analyst Level 3 


1.9 System Administrator 
1.10 Technical Architect 


1.11 Technology Architect Level 3 


B.2 Business Architect Level 3 


A.1 Application/Software Architect 
A.7 Programmer/Analyst 


|.1 Data Conversion Specialist (Cloud Level 3 
Data Scientist) 

I.1 Data Conversion Specialist (Cloud Level 3 
Data Migrations) 

C.11 IT Security Vulnerability Analysis Level 3 
Specialist (Cloud) 
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ANNEX C 
SECURITY REQUIREMENTS CHECK LIST 


(Provided under separate cover) 
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ASFC - Divulgation en vertu de la loi su 


CBSA - Released under the Access to Information 
ès à 


F'ublic Works ang Travaux publics et 
E M i PETER 
iacwvernrmient services 
Canada 


Services gouvernementaux 
Canada 


UTHORIZATK 


PART 1 (completed by the Technical/Praject Authority) / PARTI E 1 (complété par le Responsable technique / Chargé du projet) 


|A. General Information / Informations générales 


Contract Number / Numéro du contrat : 


Contractor Name / Nom du Contracteur : 


| Task Authorization (TA) No. 


Response required 
[N° de l'autorisation de tâches (AT) : 


Date of Issuance by 
Date d'émission: Réponse requise 
d'ici le : 


Commitment No. Financial Coding 
N? de l'engagement : Code financier : 


|Amendment No. / N? de la modification : 


| Reason for the Amendment / Raison pour la modification : 


ic: TA Requirements / Exigences relatives à FAT 


| Required Resource(s) / Ressource(s) requise(s) 


- | Required Level(s) of | 
Category and Level Effort (days) / : | 


Linguistic Profile / Profile — | Security / 
linguistique |  Niveau(x) de 
| sécurité requis 


Catégorie et Niveau Niveau 


| Statement of Work (tasks, deliverables, reports, etc.) / Énoncé des travaux (tâches, livrables, rapports, etc.) 


| See attached / Voir pièce jointe 


| Period of Services / Période de service: 


initial Start Date / Date de début initiale : | sd initial End Date / Date de fin initiale | 


Extented End Date (See Reason for the Amendment) / Date de fin prolongée (voir Raison pour la modification): 


| [] Option To Extend Initial End Date / Option pour prolonger la date de fin initiale 


PART 2 {completed by the Contractor and/or the Technical/Project Authority) Î PARTIE 2 (complete par le Contracteur et/ou le Responsable technique / Charge du projet) 


1 of 2 


000105 


l 
5 


l'Accé: 


Act 
linformati 


l'information 


IContractor Resource(s) and Estimated Cost / Ressource(s) du Contracteur et Coût total estimatif 


| Note: once approved, only the following resources may provide services under this TA. / Nota : une fois approuvée, seules les ressources suivantes peuvent fournir des services sous la présente AT 


| PerDiem | Estimated Level of] 

Linguistic Profile/ |  Rate/ | Effort(days)/ | 
Profil linguistique | Taux | Niveau d'effort 

| journalier | estimatif (jours) 


Total Estimated 
| Cost / | 
| Coût total estimatif | 


| PWGSC Security File 
| No. / N° du dossier de 
| sécurité TPSGC 


Name / Nom 
Category and Level / Catégorie et Niveau 


Estimated Cost / Coût estimatif | 


Total Estimated Travel and Living Cost / Coüt total estimatif de voyage et de iu 


Check applicable Basis of Payment / Maximum Price / | | Firm Price / 
Cocher la Base de Paiement applicable : Prix Maxmpm: : | Prix Ferme : 


| By signing this TA, the authorized client authority and/or the PWGSC Contracting En apposant sa signature sur l'AT, le client autorisé et/ou l'autorité contractante de 
| Authority certify(ies) that the content of this TA is in accordance with the TPSGC atteste(nt) que le contenu de cette AT est conforme aux conditions du contrat. 


| conditions of the Contract. 
| La limite d'autorisation du client est 150,000 $. Lorsque la valeur de FAT et ses 


[The client's authorization limit is $150,000. When the value of a TA and its modifications 


|amendments (excluding Applicable Taxes) is in excess of this limit, the TA must (excluant les taxes applicables) dépasse cette limite, l'AT doit être signée par le client 
ibe signed by the authorized client and forwarded to the PWGSC Contracting autorisé et transmise à l'autorité contractante de TPSGC pour autorisation 


| Authority for authorization. 


| Name of Technical Authority / Nom de l'autorité techni Date Name of Contracting Authority / Nom de l'autorité contractante Date | 


| Signature Signature 


| Name and Title of individual authorized to sign on behalf of the Contractor / Signature 
| Nom et titre Signature de la personne autorisée à signer au nom de l'entrepreneur 
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Government 
of Canada 


TBS/SCT 350-103(2004/12) 


CBSA - Released under the Access to Information Act 


ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


Gouvernement 


du Canada 


Contract — Numer Gu contrat 


1000348132 


cess lo fesincied access areas? Noscoessio T 


es à des zones d'acces resireinies? L'accés 


| Restrictedto:/Limtéa: | : estricted to: / Limité à: 


Specify countryiiesh / Préciser le(s) pays : | Specify countryüesk / Préciser y pays : 


| co CONF DENTIEL 


“UNCLASSIFIED - 
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COMMON-PS-SRCLFI 9 
| Contac Number / Numéro du contrat 


1000548132 


require access te PR > | p 
it accès à à des renseignements ou d mie isi COMSEC dosiqnes PROTÉGÉS et/ou CLASSIFIÉS? 


u de contrôle de la seturile du du personnel requis 
[7] SECRET 
Lund SECRET 


| NATO SECRET 
| NATO SECRET 


[71 CONFIDENTIAL 
.i] CONFIDENTIEL 


| NATOCONFIDENTIAL 
| NATOCONFIDENTIEL 


TOP SECRET 

TRES SECRET 

COSMIC TOP SECRET 
COSMIC TRES SECRET 


TOP SECRET. SIGINT 

TRES SECRET — SIGINT 

SITE ACCESS 

ACCÉS AUX EMPLACEMENTS 


Special comments: 
Commentaires spéciaux: —.. 


It Yes, wil unscreened personnel be escorted? 
Dans l'affrmatve, le personnel en question serai ascone? 


| INFORMATION ASSETS 


i11. a} Will the supplier be required to receive and store PROTECTED and/or CLASSIFIED information or assets on its site or 
; pre mises? 


Le fournisseur sera-t-il enu de recevoir et d'entreposer sur place des renseignements ou des biens PROTÉGÉS etou 
| CLASSIFIÉS? 
1 1. b) Will the supplier be required to safeguard COMSEC information or assets? 


Le foumisseur sera-t-il tenu de protéger des renseignements ou des biens COMSEC? 


Ll] Non | Oui 


| PRODUCTION ditiis : EE nas nas — HI — " rase RE ETRAS - 


L ym "s eti 


i 1, d) Will the supplier be required to use its IT systems to elects onicaby proces 


information or data? 


Le Toumi seur sera-Hiltenu d'utiliser ses propres systémes informatiques pour traiter, produire cu stocker électroniquement des 
renseignements ou des données PROTEGES et/ou CLASSIFIÉS? 


s. produce or store PROTECTED and/or CLASSIFIED 


| Security Classification / Classification de sécurité 
: UNCLASSIFIED 


TBS/SCT 3850-103(2004/2) 
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COMMON-PS-SRCLAI9 
Contact Number / Numéro du contrat 
1000348132 


Security Classification ! Classification de sécurité | 
NORD ns 


niveaux de csi neg requis. aux installations p ounteneur. 


A users Gampeng form online Aie the Sete the sonner spei is ey pes uh d ur Bes pelis to Astrid se 


dans le teagan (éca ap sit lat P 


Category , PROTECTED | CLASSIFIED 
Catàgora » iibi | CLASSIFIE 


j RESTRICTED COMPIGENTIAL, 


i NATO MATO 
| DIFFUSION | CONFIDENTIEL 


| 12. a) ls the description of the work contained within this SRCL PROTECTED and/or CLASSIFIED? 
i La description du travail visé par la présente LVERS est-elle de nature PROTÉGÉE et/ou CLASSIFIEE? 


I Tes, classify thie form by annotating the top and bottom in the ares entitiad “Security Classification”. 
Dans Fafiemativa, classifier le présent formulaire en indiquant ie niveau de sécurité dans ia case intitulée 
heat cure s au haut et au bee du formulaire. 


| 12. bi VMN the documentation attached to this SRCL be PROTECTED and/or CLASSIFIED? 
| La documentation associée à la présente LVERS sera-t-elle PROTEGEE et/ou CLASSIFIEE? 


y enn the top and bottom in the area entitled “Security Classification" and indicate with 

SRET with Attachments). 

firmative sifier la présent formulaire en indiquant ie niveau de sócurté dans Ia case intitulée 
Classification de sécurité » au haut ot au bas du formulaire et indiquer qu'il y a des pièces jointes ip. ax, SECRET avec 

des pièces lointes). 


TBS/SCT 350-103(2004/12) 


| UNCLASSIFIED - 
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CBSA - Released under the Access to Information Act 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information. 


Overnment Gouvernement 
of Canade. du Canada 


| Signature ¢ 


| Signature 


Digitally signed by Mansour, Silvana ] 


É Manson non Date: 2020.03.13 11:11:02 -04'00' 


Name inrint) - Nom (en lettres moutées) " | Title eu Tire : | Signature 


Saumur, Jacques 0 2 


| E-mail address - Adresse OPE | 


Jacques Saumur 

Contract Security Officer 

Contracts Secunty Division Onision des contrats sécurité / 

Contract Security Program|Programme de sécurité des contrats / 

Public Services and Procurement Canada] Services publics et Approvisionnement Canada 
Jacques Seumurfeipsgo-pwasc.gc. ca 

Telephone | Téléphone 612-048-1732 

Facsimile | Télécopieur 612-048-1712 


[Security Classification / Classifica 
| UNCLASSIFIED 


TBS/SCT 350-103(2004/12) 


tion de sécurité 
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